CT-ISG: Cooperative Security Mechanisms for DNS

CT-ISG：DNS 合作安全机制

• 批准号: 0716741
• 负责人: Prasant Mohapatra
• 金额: $ 29万
• 依托单位: University of California-Davis
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2007
• 资助国家: 美国
• 起止时间: 2007-08-15 至 2011-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0716741&HistoricalAwards=false
• 关键词: CT; ISG; Cooperative; Security; Mechanisms

CT-ISG: Cooperative Security Mechanisms for DNSThe Domain Name System (DNS) is a very valuable component in the Internet infrastructure as it provides a mapping between domain names and IP addresses for nearly all major Internet applications. Unfortunately, DNS was not designed with security in mind and has numerous vulnerabilities. Insecurity of the proxy servers and the inherent hierarchical structureof DNS makes it susceptible to the poisoning attacks. Contemporary techniques for securing DNS operations are predominantly based on cryptographic solutions. In this project, the Principal Investigator (PI) is examining cooperative techniques for enhancing security of DNS as an alternative to cryptographically secured communications as in DNSSEC. Ongoing efforts of the PI on the Domain Name Cross-referencing (DoX) have validated the potential benefits of the cooperation-based security approach. Leveraging on this effort, he is focusing on the development of an enhanced framework for guarding against the poisoning attacks on DNS.The research covers a variety of areas including a comprehensive measurement based evaluation of cooperative security, selection and maintenance of peer-groups used for cooperative security, definition and evaluation of DNS quality of service metrics through analytical modeling, and selective use of cryptographic techniques to make cooperative security mechanisms more robust. These efforts will help in developing techniques to reduce security threats such as phishing, pharming, and denial of service attacks on the DNS. In the context of broader impact, the proposed research will have a very positive impact on the Internet community in general by reducing the attacks and security threat against DNS.

域名系统是互联网基础设施中一个非常有价值的组成部分，因为它为几乎所有主要的互联网应用提供了域名和IP地址之间的映射。不幸的是，DNS在设计时没有考虑到安全性，并且有许多漏洞。代理服务器的不安全性和域名系统固有的层次化结构使其容易受到中毒攻击。当代用于保护DNS操作的技术主要基于加密解决方案。在这个项目中，首席调查员(PI)正在研究合作技术，以增强域名系统的安全性，作为DNSSEC中加密安全通信的替代方案。PI在域名交叉引用(DOX)方面的持续努力已经验证了基于合作的安全方法的潜在好处。在这一努力的基础上，他专注于开发一个增强的框架来防范针对DNS的中毒攻击。该研究涵盖了各种领域，包括基于全面测量的协作安全评估、用于协作安全的对等组的选择和维护、通过分析建模定义和评估DNS服务质量度量，以及选择性地使用密码技术使协作安全机制更加健壮。这些努力将有助于开发减少网络钓鱼、网络钓鱼和拒绝服务攻击等安全威胁的技术。在更广泛的影响背景下，拟议的研究将通过减少对域名系统的攻击和安全威胁，对整个互联网社区产生非常积极的影响。