NeTS: Small: De-Mystifying and Hardening the Domain Name System

人们不需要超越许多现实世界的广告活动来理解命名是大多数高层互联网服务建立的基本元素之一。例如，我们使用名称作为用户和服务之间的集合点：www.twitter.com、www.youtube.com、www.google.com等等。然而，名称并不直接用于在互联网上移动流量;相反，名称通过域名系统（DNS）转换为互联网地址。然后，互联网地址被用来引导世界各地网络的流量。因此，DNS查找是大多数互联网交易的先决条件。这意味着DNS不仅对互联网的运行至关重要，而且DNS实际上是大多数互联网交易的单点故障。不幸的是，DNS生态系统已经从一开始的简单系统慢慢演变为今天的广泛分布，复杂，脆弱，有时不安全的系统。当DNS由于过载而不响应查询或返回不正确的数据时，这可能会影响大量的互联网流量。该项目旨在通过以下方式解决这一关键问题：（i）对当前DNS生态系统的运行进行更深入的实证理解;（ii）开发新机制，以加强系统对不可避免地出现的良性问题和对DNS的恶意攻击的抵御能力。如果成功，这项研究将大大提高DNS系统的鲁棒性，从而提高互联网的弹性。该项目将以多种方式加速DNS生态系统的强化过程。首先，它将利用在系统中从客户端到权威DNS服务器的无数点收集的大量DNS数据，以具体了解系统的弱点。例如，该项目可以访问DNS运营分析和研究中心数据、DNS扫描数据和CCZ流量（Case Western的100个家庭的Case连接区域）。与许多互联网技术一样，测量是推动协议、服务和操作发展的关键。 第二个重点是主动增加DNS的鲁棒性。这方面的做法是设计创新机制，通过确定何时何地与生态系统中更多的行为者分享更多的信息来预测问题。 最后的推力利用以前的测量工作和设计机制的洞察力，以提高内在的系统鲁棒性。例如，该项目考虑通过消除对递归DNS解析器的依赖来重组生态系统。 本项目中开发的新机制将作为当前DNS工具的扩展发布给社区（例如，该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

One does not need to look beyond many real-world advertising campaigns to appreciate that naming is one of the foundational elements upon which most higher layer Internet services are built. For example, we use names as rendezvous points between users and services: www.twitter.com, www.youtube.com, www.google.com, to name a few. Yet, names are not directly used to move traffic across the Internet; rather, names are turned into Internet addresses via the Domain Name System (DNS). Internet addresses are then used to direct traffic around networks around the world. A DNS lookup is therefore a prerequisite for most Internet transactions. This means that the DNS is not only crucial to the operation of the Internet, but DNS is in fact a single point of failure for most Internet transactions. Unfortunately, the DNS ecosystem has slowly evolved from a simple system at its inception to a vastly distributed, complex, brittle and at times insecure system today. When the DNS does not respond to a query due to overload, or returns incorrect data, this can impact large amounts of Internet traffic. This project aims to address this critical problem by (i) developing a stronger empirical understanding of the operation of the current DNS ecosystem and (ii) developing new mechanisms to harden the system against both benign issues that inevitably crop up and malicious attacks on the DNS. If successful, this research would significantly improve the robustness of the DNS system, and thus the resilience of the Internet. This project will accelerate the process of hardening the DNS ecosystem in several ways. First, it will make use of the wealth of DNS data collected at myriad points in the system, from the clients to the authoritative DNS servers, to concretely understand the weaknesses of the system. For example, this project has access to DNS-Operations Analysis and Research Center data, DNS Scanning Data, and CCZ traffic (Case Western's Case Connection Zone of 100 homes). As with much Internet technology, measurement is key to driving the evolution of protocols, services and operations. The second thrust involves proactively adding robustness to the DNS. The approach in this thrust is to design innovative mechanisms that anticipate problems by identifying where and when to share more information with more actors in the ecosystem. The final thrust leverages insight from previous measurement efforts and design mechanisms to improve intrinsic system robustness. As an example, the project considers restructuring the ecosystem by removing reliance on recursive DNS resolvers. New mechanisms developed in this project will be released to the community as extensions to current DNS tools (e.g., the bind DNS server).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.