Utilizing the Domain Name System for Scalable and Secure Named Data Networking

The Domain Name System (DNS) is widely seen as a vital protocol of the modern Internet. For example, popular services like load balancers and Content Delivery Networks heavily rely on DNS. Because of its important role, DNS is also a desirable target for malicious activities such as spamming, phishing, and botnets. To protect networks against these attacks, a number of DNS-based security approaches have been proposed. The key insight of our study is to measure the effectiveness of security approaches that rely on DNS in large-scale networks. For this purpose, we answer the following questions, How often is DNS used? Are most of the Internet flows established after contacting DNS? In this study, we collected data from the University of Auckland campus network with more than 33,000 Internet users and processed it to find out how DNS is being used. Moreover, we studied the flows that were established with and without contacting DNS. Our results show that less than 5 percent of the observed flows use DNS. Therefore, we argue that those security approaches that solely depend on DNS are not sufficient to protect large-scale networks.

Proposes a technique that realizes the interoperability between the Dynamic Host Configuration Protocol (DHCP) and the Domain Name System (DNS) over the TCP/IP network. Through an analysis of the IP (Internet Protocol) autoconfiguration mechanism provided by DHCP, the proposal requires only minor protocol extensions, which include updating the DHCP server mechanism and a DNS server designed to support queries of a dynamically configured database. Additionally, we define new message primitives (using DNS messages) to communicate with these servers. Designing an interoperable DHCP-DNS specification provides an advantage that maintains consistency between the host name and the actual IP address allocated by the DHCP server. Thus, it prevents a specific host from leading to confusion by dynamically allocating the DHCP when it communicates with other mobile hosts.

Domain name system (DNS) is a foundational element of internet protocol (IP) communications. The global DNS is effectively a distributed hierarchical database. Each dot in a domain name indicates a boundary between tiers in the hierarchy, with each name in between dots denoted as a label. To illustrate how domain information is organized and how a DNS server leverages this hierarchical structure, this chapter gives an example name resolution. It includes a discussion regarding the distinction between zones and domains. DNS does require some basic client configuration prior to use. This initial configuration may be performed manually or by obtaining this information from a DHCP server. The chapter provides a brief overview of device resolver configuration. This background serves as a foundation for understanding the structure of data at rest on DNS servers and resolvers, as well as the process for locating DNS information within the global DNS tree.

Chapter 15 - Analyzing Internet DNS(SEC) Traffic with R for Resolving Platform Optimization

The Domain Name System (DNS) is a critical Internet infrastructure that provides name to address mapping services. In the past few years, distributed denial of service (DDoS) attacks have targeted the DNS infrastructure and threaten to disrupt this critical service. In this paper we show that the existing DNS can gain significant resilience against DDoS attacks through a simple change to the current DNS operations, by setting longer time-to-live values for a special class of DNS resource records, the infrastructure records. These records are used to navigate the DNS hierarchy and change infrequently. Furthermore, in combination with a set of simple and incrementally deployable record renewal policies, the DNS service availability can be improved by one order of magnitude. Our approach requires neither additional physical resources nor any change to the existing DNS design. We evaluate the effectiveness of our proposed enhancement by using DNS traces collected from multiple locations.

The Domain Name System (DNS) is an essential part of the Internet on whose function many other protocols rely. One key DNS function is Dynamic Update, which allows hosts on the network to make updates to DNS records dynamically, without the need for restarting the DNS service. Unfortunately, this dynamic process does expose DNS servers to security issues. To address these issues two protocols were introduced: Transaction Signature (TSIG) and Domain Name System Security Extensions (DNSSEC). In Internet Protocol version 4 (IPv4) networks using these protocols eliminated security issues. In Internet Protocol version 6 (IPv6) however, there is an issue with the DNS authentication process when using the Stateless Address Auto Configuration (SLAAC) mechanism (new to IPv6, nonexistent in IPv4). This authentication issue occurs when a node wants to update its resource records on a DNS server, during the DNS update process, or when a client wants to authenticate a DNS resolver to ensure that the DNS response does not contain a spoofed source address or message. In this paper we propose the use of a new mechanism which makes use of asymmetric cryptography to establish a trust relationship with the DNS server. We also consider the use of the current security parameters used to generate IPv6 addresses in a secure manner, i.e. Secure Neighbor Discovery (SeND), for assuring clients and DNS servers that the one they are communicating with is the real owner of this IP address. Since we are extending the RDATA field within the TSIG protocol to accommodate these new security parameters, we will call this new mechanism the CGA-TSIG algorithm.

Securing the internet’s backbone: A blockchain-based and incentive-driven architecture for DNS cache poisoning defense

We discuss the primarily role of anonymity and identity manipulation in information warfare. We contend that those who engage in information warfare have very similar goals as those involved in cyber-crime and cyber-terrorism. Today Internet-based commerce has become global, representing a significant component of the world market. Network-based personal communications services are rapidly becoming the method of choice for many nations. In fact many critical infrastructure components are managed and controlled remotely. Yet these various capabilities are usurped by cyber-warriors, terrorists, or other criminals. A number of networking issues contribute to the current state of Information Warfare. Historically, security capabilities (e.g., authentication, authorization, and confidentiality services) had not been considered a high priority in the original design of the critical Internet protocols still in use. Further complicating the security problem is the lack of consistency in name scheme adopted for network-related objects (hosts, applications, interfaces). Mapping of object names continues to be a trial-by-error exercise, which is frequently misused by malicious actors, as in the case of Address Resolution Protocol (ARP). Moreover, the lack of authentication facilitates the use of ICMPv4 (internet control message protocol version 4) and UDP (user datagram protocol) as protocols of choice for distributed denial-of-service (DDoS) attacks. Dynamically used transport protocol port numbers are now common: negating the effectiveness of classic firewall type packet filtering. Regrettably, mapping of device domain names to IP (internet protocol) addresses via DNS (domain name system) continues with no major efforts to prevent invalid updates or query responses. Many of the aforementioned protocols rely on data-origin authentication via secret key and message digests, yet, secret key management is non-existent. IEEE 802.1X, used in newer wireless networks, is routinely avoided for wired infrastructures. Although internet protocol security (IPsec) is widely available, it is rarely deployed beyond secure virtual private networks (VPNs), especially given that its availability in IPv4 is optional and usage optional with IPv4 and IPv6. Domain name system security (DNSSEC) has existed for over 10 years, yet serious discussion for its deployment is only now occurring. The standards for public key infrastructures (PKIs) and digital certificates are extensive but the majority of organizations find excuses to avoid its use and most PKI-enabled applications cannot even check for revoked certificates. In conclusion, we contend that given the security threats associated with current and future information warfare activities, the inter-networked global community should focus on more rapid implementation and deployment of the existing security mechanisms. As such, mandatory, robust authentication as well as several key network security services should be adopted. The necessary mechanisms already exist, now is the time for network administrators to recognize the need for prompt deployment of these capabilities as a proactive defense/mitigation against malicious attacks at reasonable level.

Software Defined Networking (SDN) and Named-Data Networking (NDN) are two new paradigms that aim at changing the way we design and architect computer networks. The NDN architecture was first proposed to solve the problems of current Internet Protocol (IP) communication. However, there is an important disadvantages in the existing NDN, which are the very large size of the NDN forwarding table and the huge overhead cost of the forwarding process. This may result in not only a slow delivery of data, but also in a lot of network traffics. For this reason, this architecture cannot be appropriately used in a large-scale network.To solve this problem, we proposed a novel forwarding Strategy for Named Data Networking based on SDN and bloom Filter (NDN-SF) in order to improve the efficiency of content delivery and enhance the consumption of network resources. Our experimental results showed that latency and bandwidth consumption are reasonably low in our method NDN-SF. They also demonstrated that the developed scheme is more efficient than the existing forwarding strategies in NDN.

Domain Name System (DNS) is an essential component in internet infrastructure to direct domains to IP addresses or conversely. Despite its important role in delivering internet services, attackers often use DNS as a bridge to breach a system. A DNS traffic analysis system is needed for early detection of attacks. However, the available security tools still have many shortcomings, for example broken authentication, sensitive data exposure, injection, etc. This research uses DNS analysis to develop anomaly-based techniques to detect malicious traffic on the DNS infrastructure. To do this, We look for network features that characterize DNS traffic. Features obtained will then be processed using the Decision Tree algorithm to classifyincoming DNS traffic. We experimented with 2.291.024 data traffic data matches the characteristics of BotNet and normal traffic. By dividing the data into 80% training and 20% testing data, our experimental results showed high detection aacuracy (96.36%) indicating the robustness of our method.

DNS amplification attack revisited

Disasters are uncertain occasions that can impose a drastic impact on human life and building infrastructures. Information and Communication Technology (ICT) plays a vital role in coping with such situations by enabling and integrating multiple technological resources to develop Disaster Management Systems (DMSs). In this context, a majority of the existing DMSs use networking architectures based upon the Internet Protocol (IP) focusing on location-dependent communications. However, IP-based communications face the limitations of inefficient bandwidth utilization, high processing, data security, and excessive memory intake. To address these issues, Named Data Networking (NDN) has emerged as a promising communication paradigm, which is based on the Information-Centric Networking (ICN) architecture. An NDN is among the self-organizing communication networks that reduces the complexity of networking systems in addition to provide content security. Given this, many NDN-based DMSs have been proposed. The problem with the existing NDN-based DMS is that they use a PULL-based mechanism that ultimately results in higher delay and more energy consumption. In order to cater for time-critical scenarios, emergence-driven network engineering communication and computation models are required. In this paper, a novel DMS is proposed, i.e., Named Data Networking Disaster Management (NDN-DM), where a producer forwards a fire alert message to neighbouring consumers. This makes the nodes converge according to the disaster situation in a more efficient and secure way. Furthermore, we consider a fire scenario in a university campus and mobile nodes in the campus collaborate with each other to manage the fire situation. The proposed framework has been mathematically modeled and formally proved using timed automata-based transition systems and a real-time model checker, respectively. Additionally, the evaluation of the proposed NDM-DM has been performed using NS2. The results prove that the proposed scheme has reduced the end-to-end delay up from 2 % to 10 % and minimized up to 20 % energy consumption, as energy improved from 3 % to 20 % compared with a state-of-the-art NDN-based DMS.

In current Internet applications, naming is constructed by the location of host and the resource in the host, and name resolution mapping system is constructed by a treelike domain name system (DNS). These architectures has some shortcomings, such as not supporting data migration and replication, vulnerable to Denial of Service (DoS) attacks. Researchers have proposed a DHT-based flat structure to achieve naming and name resolution mapping. to deals with the shortcomings of DNS above, but it introduces a new problem that the resolution time cost is too large that users often can not tolerate this long delay. In this paper, we present an improved structure called Hierarchical Name System (HNS) by combining the advantages of DNS and DHT. The architecture of HNS is a two-layer's structure, namely top-layer which maintains the global information and bottom-layer which maintains local information. Owning to the location information, the resolution delay is greatly reduced while the shortcomings of DNS have been eliminated.

Software Defined Network (SDN) is getting popularity both from academic and industry. Lot of researches have been made to combine SDN with future Internet paradigms to manage and control networks efficiently. SDN provides better management and control in a network through decoupling of data and control plane. Named Data Networking (NDN) is a future Internet technique with aim to replace IPv4 addressing problems. In NDN, communication between different nodes done on the basis of content names rather than IP addresses. Vehicular Ad-hoc Network (VANET) is a subtype of MANET which is also considered as a hot area for future applications. Different vehicles communicate with each other to form a network known as VANET. Communication between VANET can be done in two ways (i) Vehicle to Vehicle (V2V) (ii) Vehicle to Infrastructure (V2I). Combination of SDN and NDN techniques in future Internet can solve lot of problems which were hard to answer by considering a single technique. Security in VANET is always challenging due to unstable topology of VANET. In this paper, we merge future Internet techniques and propose a new scheme to answer timing attack problem in VANETs named as Timing Attack Prevention (TAP) protocol. Proposed scheme is evaluated through simulations which shows the superiority of proposed protocol regarding detection and mitigation of attacker vehicles as compared to normal timing attack scenario in NDN based VANET.

Domain Name System (DNS) is a widely used infrastructure for remote control and batch management of IoT devices. As a critical Internet infrastructure, DNS is structured as a tree‐like hierarchy with single root zone authority at the top, which puts the operation of DNS at risk from single point of failure. The current root zone management is lack of transparency and accountability, since only the root zone file is published as the final outcome of operations inside the root zone authority. Towards distributed root zone operation in DNS, this paper presents a blockchain‐based root operation architecture—RootChain, composed of multiple root servers. On the basis of maintaining the single root authority for top‐level domain (TLD), RootChain decentralizes TLD data publication by empowering delegated TLD authorities to publish authenticated data directly. The transparency and accountability of root zone operation are attained by smart‐contracting the whole life cycle of TLD operation and logging all operations on the chain. RootChain is transparent to recursive/stub resolver and DNS/DNSSEC‐compatible. A proof‐of‐concept prototype of RootChain has been implemented with Hyperledger Fabric and evaluated by experiments.