IEICE TRANSACTIONS on Information
A Client Based DNSSEC Validation System with Adaptive Alert Mechanism Considering Minimal Client Timeout
Summary :
The widespread usage of computers and communication networks affects people's social activities effectively in terms of intercommunication and the communication generally begins with domain name resolutions which are mainly provided by DNS (Domain Name System). Meanwhile, continuous cyber threats to DNS such as cache poisoning also affects computer networks critically. DNSSEC (DNS Security Extensions) is designed to provide secure name resolution between authoritative zone servers and DNS full resolvers. However high workload of DNSSEC validation on DNS full resolvers and complex key management on authoritative zone servers hinder its wide deployment. Moreover, querying clients use the name resolution results validated on DNS full resolvers, therefore they only get errors when DNSSEC validation fails or times out. In addition, name resolution failure can occur on querying clients due to technical and operational issues of DNSSEC. In this paper, we propose a client based DNSSEC validation system with adaptive alert mechanism considering minimal querying client timeout. The proposed system notifies the user of alert messages with answers even when the DNSSEC validation on the client fails or timeout so that the user can determine how to handle the received answers. We also implemented a prototype system and evaluated the features on a local experimental network as well as in the Internet. The contribution of this article is that the proposed system not only can mitigate the workload of DNS full resolvers but also can cover querying clients with secure name resolution, and by solving the existing operation issues in DNSSEC, it also can promote DNSSEC deployment.
- Publication
- IEICE TRANSACTIONS on Information Vol.E100-D No.8 pp.1751-1761
- Publication Date
- 2017/08/01
- Publicized
- 2017/05/18
- Online ISSN
- 1745-1361
- DOI
- 10.1587/transinf.2016ICP0028
- Type of Manuscript
- Special Section PAPER (Special Section on Information and Communication System Security)
- Category
- Internet Security
Authors
Yong JIN
Tokyo Institute of Technology
Kunitaka KAKOI
Tokyo University of Agriculture and Technology
Nariyoshi YAMAI
Tokyo University of Agriculture and Technology
Naoya KITAGAWA
Tokyo University of Agriculture and Technology
Masahiko TOMOISHI
Tokyo Institute of Technology
Keyword
Latest Issue
Copyrights notice of machine-translated contents
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Cite this
Copy
Yong JIN, Kunitaka KAKOI, Nariyoshi YAMAI, Naoya KITAGAWA, Masahiko TOMOISHI, "A Client Based DNSSEC Validation System with Adaptive Alert Mechanism Considering Minimal Client Timeout" in IEICE TRANSACTIONS on Information,
vol. E100-D, no. 8, pp. 1751-1761, August 2017, doi: 10.1587/transinf.2016ICP0028.
Abstract: The widespread usage of computers and communication networks affects people's social activities effectively in terms of intercommunication and the communication generally begins with domain name resolutions which are mainly provided by DNS (Domain Name System). Meanwhile, continuous cyber threats to DNS such as cache poisoning also affects computer networks critically. DNSSEC (DNS Security Extensions) is designed to provide secure name resolution between authoritative zone servers and DNS full resolvers. However high workload of DNSSEC validation on DNS full resolvers and complex key management on authoritative zone servers hinder its wide deployment. Moreover, querying clients use the name resolution results validated on DNS full resolvers, therefore they only get errors when DNSSEC validation fails or times out. In addition, name resolution failure can occur on querying clients due to technical and operational issues of DNSSEC. In this paper, we propose a client based DNSSEC validation system with adaptive alert mechanism considering minimal querying client timeout. The proposed system notifies the user of alert messages with answers even when the DNSSEC validation on the client fails or timeout so that the user can determine how to handle the received answers. We also implemented a prototype system and evaluated the features on a local experimental network as well as in the Internet. The contribution of this article is that the proposed system not only can mitigate the workload of DNS full resolvers but also can cover querying clients with secure name resolution, and by solving the existing operation issues in DNSSEC, it also can promote DNSSEC deployment.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.2016ICP0028/_p
Copy
@ARTICLE{e100-d_8_1751,
author={Yong JIN, Kunitaka KAKOI, Nariyoshi YAMAI, Naoya KITAGAWA, Masahiko TOMOISHI, },
journal={IEICE TRANSACTIONS on Information},
title={A Client Based DNSSEC Validation System with Adaptive Alert Mechanism Considering Minimal Client Timeout},
year={2017},
volume={E100-D},
number={8},
pages={1751-1761},
abstract={The widespread usage of computers and communication networks affects people's social activities effectively in terms of intercommunication and the communication generally begins with domain name resolutions which are mainly provided by DNS (Domain Name System). Meanwhile, continuous cyber threats to DNS such as cache poisoning also affects computer networks critically. DNSSEC (DNS Security Extensions) is designed to provide secure name resolution between authoritative zone servers and DNS full resolvers. However high workload of DNSSEC validation on DNS full resolvers and complex key management on authoritative zone servers hinder its wide deployment. Moreover, querying clients use the name resolution results validated on DNS full resolvers, therefore they only get errors when DNSSEC validation fails or times out. In addition, name resolution failure can occur on querying clients due to technical and operational issues of DNSSEC. In this paper, we propose a client based DNSSEC validation system with adaptive alert mechanism considering minimal querying client timeout. The proposed system notifies the user of alert messages with answers even when the DNSSEC validation on the client fails or timeout so that the user can determine how to handle the received answers. We also implemented a prototype system and evaluated the features on a local experimental network as well as in the Internet. The contribution of this article is that the proposed system not only can mitigate the workload of DNS full resolvers but also can cover querying clients with secure name resolution, and by solving the existing operation issues in DNSSEC, it also can promote DNSSEC deployment.},
keywords={},
doi={10.1587/transinf.2016ICP0028},
ISSN={1745-1361},
month={August},}
Copy
TY - JOUR
TI - A Client Based DNSSEC Validation System with Adaptive Alert Mechanism Considering Minimal Client Timeout
T2 - IEICE TRANSACTIONS on Information
SP - 1751
EP - 1761
AU - Yong JIN
AU - Kunitaka KAKOI
AU - Nariyoshi YAMAI
AU - Naoya KITAGAWA
AU - Masahiko TOMOISHI
PY - 2017
DO - 10.1587/transinf.2016ICP0028
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E100-D
IS - 8
JA - IEICE TRANSACTIONS on Information
Y1 - August 2017
AB - The widespread usage of computers and communication networks affects people's social activities effectively in terms of intercommunication and the communication generally begins with domain name resolutions which are mainly provided by DNS (Domain Name System). Meanwhile, continuous cyber threats to DNS such as cache poisoning also affects computer networks critically. DNSSEC (DNS Security Extensions) is designed to provide secure name resolution between authoritative zone servers and DNS full resolvers. However high workload of DNSSEC validation on DNS full resolvers and complex key management on authoritative zone servers hinder its wide deployment. Moreover, querying clients use the name resolution results validated on DNS full resolvers, therefore they only get errors when DNSSEC validation fails or times out. In addition, name resolution failure can occur on querying clients due to technical and operational issues of DNSSEC. In this paper, we propose a client based DNSSEC validation system with adaptive alert mechanism considering minimal querying client timeout. The proposed system notifies the user of alert messages with answers even when the DNSSEC validation on the client fails or timeout so that the user can determine how to handle the received answers. We also implemented a prototype system and evaluated the features on a local experimental network as well as in the Internet. The contribution of this article is that the proposed system not only can mitigate the workload of DNS full resolvers but also can cover querying clients with secure name resolution, and by solving the existing operation issues in DNSSEC, it also can promote DNSSEC deployment.
ER -
English
