Measuring the Practical Impact of DNSSEC Deployment
Measuring the Practical Impact of DNSSEC Deployment
复制标题
衡量 DNSSEC 部署的实际影响
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
S. Savage
中科院分区：
文献类型：
--
作者：
Wilson Lian;E. Rescorla;H. Shacham;S. Savage
DNSSEC通过公钥基础设施扩展DNS，为兼容客户端提供他们获得的DNS记录的加密保证，即使存在活跃的网络攻击者。与许多Internet协议部署一样，决定是否为其DNS区域部署DNSSEC的管理员必须执行成本/效益分析。对于一部分客户端--那些执行DNSSEC验证的客户端--该区域将受到保护，免受恶意劫持。但是另一部分客户端--那些DNS解析器有缺陷且与DNSSEC不兼容的客户端--将不再能够连接到该区域。部署DNSSEC需要做出成本效益决策，平衡某些用户的安全性和其他用户的拒绝服务。
我们使用广告网络从超过500，000个地理分布的客户端收集结果，对DNSSEC对客户名称解析的影响进行了大规模测量。我们的研究结果证实了先前研究人员的研究结果，即相对较小比例的用户受到DNSSEC验证解析器的保护。我们首次表明，启用DNSSEC会显著增加端到端解析失败。当一个域部署DNSSEC时，每10个受到保护免受DNS篡改的客户端中，大约有一个普通客户端（主要在亚洲）无法访问该域。
DNSSEC extends DNS with a public-key infrastructure, providing compatible clients with cryptographic assurance for DNS records they obtain, even in the presence of an active network attacker. As with many Internet protocol deployments, administrators deciding whether to deploy DNSSEC for their DNS zones must perform cost/benefit analysis. For some fraction of clients--those that perform DNSSEC validation--the zone will be protected from malicious hijacking. But another fraction of clients--those whose DNS resolvers are buggy and incompatible with DNSSEC--will no longer be able to connect to the zone. Deploying DNSSEC requires making a cost-benefit decision, balancing security for some users with denial of service for others.
We have performed a large-scale measurement of the effects of DNSSEC on client name resolution using an ad network to collect results from over 500,000 geographically-distributed clients. Our findings corroborate those of previous researchers in showing that a relatively small fraction of users are protected by DNSSEC-validating resolvers. And we show, for the first time, that enabling DNSSEC measurably increases end-to-end resolution failures. For every 10 clients that are protected from DNS tampering when a domain deploys DNSSEC, approximately one ordinary client (primarily in Asia) becomes unable to access the domain.