A Secure, Flexible Framework for DNS Authentication in IPv6 Autoconfiguration

The Domain Name System (DNS) is a necessary component of the Internet that allows hosts on the Internet to communicate with other hosts without needing to know their cryptic IP addresses. When this protocol was first introduced it did not contain robust security features because scalability was an issue. One of the useful features added to DNS was the DNS update mechanism that allowed other hosts to dynamically change DNS entries. This feature, though, exposed new vulnerabilities to DNS servers which necessitated the implementation of new security protocols. Some of the security protocols introduced to address these issues were Transaction SIGnature (TSIG) and DNS Security Extension (DNSSEC). Although, in IPv4, these mechanisms did resolve most of the security issues dealing with authentication between a node and a DNS server, they are not viable in IPv6 networks. This is because the Neighbor Discovery Protocol (NDP) introduced to organize the large IPv6 address space automatically does not support DNS authentication or have an option for secure DNS updating. In this chapter, the authors first explain the common approaches used in IPv4 to address these security issues. Then they explain the differences between the use of these approaches in IPv4 and IPv6, where the focus is on new research with regard to authentication mechanisms between hosts and DNS servers.

Visualizing and characterizing DNS lookup behaviors via log-mining

The Domain Name System (DNS) is the backbone of the internet. It is a distributed hierarchical database which stores resource records like A, MX, AAAA, CNAME. The whole DNS is classified into three layers - root, top-level domain (TLD) and authoritative DNS servers. Each level has its own responsibility to resolve certain categories of domain names. It is very difficult for us to memorize the IP address of each site which we need to visit. In this case, the DNS comes into rescue to figure out the corresponding IP address a domain points to. In the current world, the internet is an inevitable part of our life and DNS is the soul of the internet. Due to this reason, DNS is a major attack target like amplification attack, cache poisoning attack, DNS hijacking, NXDomain attack and Phantom domain attack. These attacks could create a serious security threat to internet users. Threats can be a simple redirection to potentially stealing user credentials. Even though different mitigation techniques are available, the threat still exists. In this paper, we present our survey of the existing research and its shortcomings on securing the DNS. We have also introduced a novel idea which uses blockchain technology to validate the response sent by the DNS servers.

The existence of the Domain Name System (DNS) through the role of the DNS Record, functions to translate domain addresses into IP addresses. High availability is an absolute condition so that the service from the DNS Server is still available and running well. To make this happen, it is necessary to have an asynchronous API on the DNS server and data management on the DNS record. This research designs and implements RESTKnot as an asynchronous API on DNS Server for DNS record management, accompanied by high availability testing using Load Balancing techniques and the Round Robin (RR) algorithm. The test results show that RESTKnot can help the DNS record management process dynamically, where DNS records can be made through the RESTKnot API and RESTKnot CLI, to be sent to the RESTKnot agent and executed by Knot DNS. The test results also show that RESTKnot can realize high availability through a ten-time system access test scenario, where heavy traffic on the first web server can be immediately diverted to the second web server to achieve high availability.

When a DNS (domain name system) client needs to look up a name, it queries DNS servers to resolve the name on the Internet. The query information from the client was passed through one or more DNS servers. While useful, in the whole query transmission, we say it can leak potentially sensitive information: what a client wants to connect to, or what the client is always paying attention to. From the definition, the privacy problem is to prove that none of the private data can be inferred from the information which is made public. We first analyzed the complete DNS query process now in use; then, from each step of the DNS query process, we discussed the privacy disclosure problem in each step of the query: client side, query transmission process and DNS server side. Finally, we proposed a simple and flexible privacy-preserving query scheme "range query", which could maximally decrease privacy disclosure in the whole DNS query process. And we also discuss efficiency and implementation on the range query.

Cyberattacks significantly impact the services based on the internet that is used in our daily lives. Any disruption will make it extremely difficult for us to carry out our daily activities. Cyberattacks will disrupt online services, exploit vulnerabilities to breach databases and servers, and so on. Various systems and services contribute to the Internet’s seamless functionality. The Domain Name System (DNS) is one of the most important services. DNS is used to resolve domain names into machine-readable IP addresses. DNS, like many other Internet services, is vulnerable to cyber-attacks. While DNS faces a slew of threats, one in particular appears to stand out. DNS is vulnerable to a variety of distributed denial-of-service attacks. The distributed reflection denial of service (DRDoS) attack, a flooding attack against DNS servers that renders them unavailable, disrupting domain name resolution activities, is one of the most common variants. DRDoS attacks have been on the rise in recent years. DNS lookup outages would significantly impact our online activities in the world of ultra-connectivity because they are typically the first step in establishing a connection with a server. The purpose of this paper is to present a state-of-the-art review of DRDoS attack detection and mitigation algorithms as well as the datasets on which these algorithms operate. Finally, we discussed each of these algorithms' relative merits and demerits.

A domain name system (DNS) is one of the most important infrastructures of the Internet communication. It is also a crucial point which is subjected to attacks. The largest distributed denial-of-service (DDoS) attack on October 21, 2016 has targeted a major DNS infrastructure named dynDNS. It was actually the Internet of Things (IoT) DNS flood attack that made more than half of websites in the United States unreachable for a significant amount of time. As we are using the Internet for everything in our life, especially health care and transportation, an attack of this type may cause a major disruption. Therefore, in this article, we are going to analyze the DNS flood attacks and propose two mitigation methods. We propose a load distributed mitigation process which will work as a quick escape route of the legitimate traffic from the attack field. Our solution mainly involves service level changes which can be implemented with collaboration among service providers. Also, our proposed solution is very cost effective as compared to the cost of downtime of the domain names caused by a DNS flood attack. Furthermore, we propose a benign-bot mitigation method and a business model for the method. In the benign-bot mitigation method, a bot program is installed in customers' DNS local servers to allow IP addresses of a list of paid businesses' websites to maintain in the caches so that the websites can be accessed even when the DNS servers are down.

Domain name system (DNS) is a foundational element of internet protocol (IP) communications. The global DNS is effectively a distributed hierarchical database. Each dot in a domain name indicates a boundary between tiers in the hierarchy, with each name in between dots denoted as a label. To illustrate how domain information is organized and how a DNS server leverages this hierarchical structure, this chapter gives an example name resolution. It includes a discussion regarding the distinction between zones and domains. DNS does require some basic client configuration prior to use. This initial configuration may be performed manually or by obtaining this information from a DHCP server. The chapter provides a brief overview of device resolver configuration. This background serves as a foundation for understanding the structure of data at rest on DNS servers and resolvers, as well as the process for locating DNS information within the global DNS tree.

Current Content Delivery Networks (CDNs) primarily utilize the Domain Name System (DNS) to direct users towards optimal content replica servers. Typically, these CDNs will leverage specialized DNS servers to perform load balancing, by providing different users with different IP endpoints for a particular hostname. However, there typically exists some form of DNS cache between the user and the authoritative DNS for a particular web service (Examples include web browsers, operating systems, and home routers). While these DNS caches typically improve user experience and network performance by reducing the number of redundant DNS requests, there exist scenarios where the presence of a DNS cache can actually harm network performance and user experience. For example: if a server or datacentre were to suddenly become unavailable, end users may become `stuck' trying to access the old IP address contained in their DNS caches, even though the authoritative DNS server may have updated it's records accordingly. In order to address this issue, we propose a system that enables network operators to transparently redirect users towards optimal servers during times of network congestion or high server load. By leveraging SDN and NFV, we are able to implement this system over a variety of network infrastructures, and to various levels of scale. Our initial tests indicate that our methodology has the capability to vastly improve user experience by several orders of magnitude during times of high network load, over a variety of network conditions. Our system is application-layer agnostic, and is compatible with various networking protocols.

Ever since the introduction of the domain name system (DNS), attacks on the DNS ecosystem have been a steady companion. Over time, targets and techniques have shifted, and in the recent past a new type of attack on the DNS has emerged. In this paper we report on the DNS random subdomain attack, querying floods of non-existent subdomains, intended to cause a denial-of-service on DNS servers. Based on five major attacks in 2018 obtained through backscatter measurements in a large network telescope, we show the techniques pursued by adversaries, and develop a taxonomy of strategies of this attack.

Domain Name System (DNS) has become a target of the Distributed Denial of Service (DDoS) attacks. When a DNS is under a DDoS flood attack, all the domain information under that DNS becomes unreachable, eventually causing unavailability of those particular domain names. In this paper, we propose a method which includes periodic stale content update and maintains a list of most frequently queried domain names of different DNS servers. Our simulation results show that the our method can serve more than \(70\%\) of the total cache responses during a massive DNS Flood attack.

5G brings many improvements to cellular networks in terms of performance, such as lower latency, improved network efficiency, and higher throughput, making it an attractive candidate for many applications. One such domain is industrial applications that may require real-time guarantees to transmit time-critical control messages. Assuming the immense number of devices exchanging data in support of Massive Machine-Type Communications (mMTC) applications, the capability of the cellular infrastructure to handle a large number of real-time transmissions may be inadequate. For such cases, there exists an acute desire to reduce any overheads as much as possible in order to guarantee certain deadlines. One such target is the Domain Name System (DNS) service, for which queries precede almost every new network request. This incorporates additional communication delays based on the response time, which in turn is affected by the proximity of the DNS server. While bringing DNS service to the edge has been touted as a logical solution, its integration with 5G systems is still challenging. This is due to the inability to access the DNS query information at the application layer since the User Equipment (UE) traffic is tunneled through to the core network. To this end, we propose a novel approach that can identify DNS queries at the base stations through Software-Defined Networking (SDN) capabilities. Specifically, we develop an SDN controller which is used to identify and extract DNS queries at the base station and handle the query at the edge without going through the 5G core network. This approach was implemented in a virtualized 5G network, in which we demonstrate that it is feasible and can potentially bring significant performance gains, especially in the case of mMTC applications.

The domain name system (DNS) is a cornerstone for the Internet and the most globally deployed Internet service that provides user-friendly naming for Internet hosts. DNS is a distributed data base that allows convenient storing and retrieving of resource records. Recently an interesting feature was added to BIND implementation of the DNS system to support secure dynamic updates. In this paper, we use the DNS and its ability to support dynamic updates to propose a mobility solution that locates and tracks mobile hosts while they change there points of attachment (IP addresses) in the network. The main objectives of this paper is to study and re-evaluate the DNS system with respect to dynamic updating protocol and provide a performance study to determine the ability of the DNS to support mobility and real time services. The experimental results have shown that updating speeds (i.e. propagation of updates along the system) are fast enough for the DNS to provide real time services, and we can conclude that the conventional DNS system with the dynamic updating feature can be used in a macro mobility handling scheme.

Domain Name System (DNS) enables users to access websites via domain names, offering convenient navigation. However, criminals can exploit this convenience to redirect connections from user devices to fake servers for a variety of purposes. A form of attack known as DNS cache poisoning exploits vulnerabilities in the Domain Name System (DNS) to redirect connections from a legitimate website address to an illegitimate one. As a consequence of the fact that users of networked systems are typically unaware that they are accessing an illegitimate site, this attack can have a particularly damaging impact. Such incidents can give rise to several issues, including the theft of data, the distribution of malware, and other security threats. To address this issue, this study employs a firewall in conjunction with DoH (DNS over HTTPS) and the utilization of registered certificates. The Domain Name System over HTTPS (DoH) protocol encrypts DNS requests and responses, preventing third parties (such as attackers who manipulate DNS) from reading or modifying DNS requests. The data employed in this study is derived from a review of existing literature. Furthermore, this study employs the PPDIOO model (Preparation, Planning, Design, Implementation, Operation, and Optimization) for the development of the network. Furthermore, the Mikrotik RB951ui-2Hnd routerboard is employed in this study. The outcome is the implementation of a multifaceted security strategy that effectively mitigates DNS cache poisoning attacks by 100%, while simultaneously reducing CPU usage to 11.5%. This approach enhances the security and reliability of user search activities on the internet.

We discuss the primarily role of anonymity and identity manipulation in information warfare. We contend that those who engage in information warfare have very similar goals as those involved in cyber-crime and cyber-terrorism. Today Internet-based commerce has become global, representing a significant component of the world market. Network-based personal communications services are rapidly becoming the method of choice for many nations. In fact many critical infrastructure components are managed and controlled remotely. Yet these various capabilities are usurped by cyber-warriors, terrorists, or other criminals. A number of networking issues contribute to the current state of Information Warfare. Historically, security capabilities (e.g., authentication, authorization, and confidentiality services) had not been considered a high priority in the original design of the critical Internet protocols still in use. Further complicating the security problem is the lack of consistency in name scheme adopted for network-related objects (hosts, applications, interfaces). Mapping of object names continues to be a trial-by-error exercise, which is frequently misused by malicious actors, as in the case of Address Resolution Protocol (ARP). Moreover, the lack of authentication facilitates the use of ICMPv4 (internet control message protocol version 4) and UDP (user datagram protocol) as protocols of choice for distributed denial-of-service (DDoS) attacks. Dynamically used transport protocol port numbers are now common: negating the effectiveness of classic firewall type packet filtering. Regrettably, mapping of device domain names to IP (internet protocol) addresses via DNS (domain name system) continues with no major efforts to prevent invalid updates or query responses. Many of the aforementioned protocols rely on data-origin authentication via secret key and message digests, yet, secret key management is non-existent. IEEE 802.1X, used in newer wireless networks, is routinely avoided for wired infrastructures. Although internet protocol security (IPsec) is widely available, it is rarely deployed beyond secure virtual private networks (VPNs), especially given that its availability in IPv4 is optional and usage optional with IPv4 and IPv6. Domain name system security (DNSSEC) has existed for over 10 years, yet serious discussion for its deployment is only now occurring. The standards for public key infrastructures (PKIs) and digital certificates are extensive but the majority of organizations find excuses to avoid its use and most PKI-enabled applications cannot even check for revoked certificates. In conclusion, we contend that given the security threats associated with current and future information warfare activities, the inter-networked global community should focus on more rapid implementation and deployment of the existing security mechanisms. As such, mandatory, robust authentication as well as several key network security services should be adopted. The necessary mechanisms already exist, now is the time for network administrators to recognize the need for prompt deployment of these capabilities as a proactive defense/mitigation against malicious attacks at reasonable level.