NeTS: Small: De-Mystifying and Hardening the Domain Name System

人们不需要超越许多现实世界的广告活动就能意识到，命名是大多数高层互联网服务建立在其基础上的基本元素之一。例如，我们使用名称作为用户和服务之间的交汇点：www.twitter.com、www.youtube.com、www.google.com等等。然而，名称并不直接用于在Internet上传输流量，而是通过域名系统(DNS)将名称转换为Internet地址。然后，互联网地址被用来在世界各地的网络中引导流量。因此，大多数互联网交易的先决条件是进行域名系统查询。这意味着，域名系统不仅对互联网的运行至关重要，而且实际上是大多数互联网交易的单一故障点。不幸的是，DNS生态系统已经从一开始的一个简单系统慢慢演变成今天一个高度分散、复杂、脆弱、有时甚至不安全的系统。当DNS由于过载而没有响应查询，或者返回不正确的数据时，可能会影响大量的互联网流量。该项目旨在通过以下方式解决这一关键问题：(I)加强对当前域名系统生态系统运作的经验了解，(Ii)开发新的机制，以加强系统对不可避免地突然出现的良性问题和对域名系统的恶意攻击。如果成功，这项研究将显著提高域名系统的健壮性，从而提高互联网的弹性。该项目将通过几种方式加快强化域名系统生态系统的进程。首先，它将利用在系统中无数个点收集的丰富的DNS数据，从客户端到权威的DNS服务器，具体了解系统的弱点。例如，该项目可以访问DNS-运营分析和研究中心数据、DNS扫描数据和CCZ流量(Case Western的Case Connection Zone of 100个家庭)。与许多互联网技术一样，测量是推动协议、服务和运营演变的关键。第二个推动力涉及主动增加域名系统的健壮性。这一努力的方法是设计创新的机制，通过确定在哪里以及何时与生态系统中的更多参与者共享更多信息来预测问题。最后的推力利用从以前的测量工作和设计机制中获得的洞察力来提高内部系统的健壮性。例如，该项目考虑通过消除对递归DNS解析器的依赖来重组生态系统。在该项目中开发的新机制将作为当前域名系统工具(例如，BIND域名系统服务器)的扩展向社区发布。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

One does not need to look beyond many real-world advertising campaigns to appreciate that naming is one of the foundational elements upon which most higher layer Internet services are built. For example, we use names as rendezvous points between users and services: www.twitter.com, www.youtube.com, www.google.com, to name a few. Yet, names are not directly used to move traffic across the Internet; rather, names are turned into Internet addresses via the Domain Name System (DNS). Internet addresses are then used to direct traffic around networks around the world. A DNS lookup is therefore a prerequisite for most Internet transactions. This means that the DNS is not only crucial to the operation of the Internet, but DNS is in fact a single point of failure for most Internet transactions. Unfortunately, the DNS ecosystem has slowly evolved from a simple system at its inception to a vastly distributed, complex, brittle and at times insecure system today. When the DNS does not respond to a query due to overload, or returns incorrect data, this can impact large amounts of Internet traffic. This project aims to address this critical problem by (i) developing a stronger empirical understanding of the operation of the current DNS ecosystem and (ii) developing new mechanisms to harden the system against both benign issues that inevitably crop up and malicious attacks on the DNS. If successful, this research would significantly improve the robustness of the DNS system, and thus the resilience of the Internet. This project will accelerate the process of hardening the DNS ecosystem in several ways. First, it will make use of the wealth of DNS data collected at myriad points in the system, from the clients to the authoritative DNS servers, to concretely understand the weaknesses of the system. For example, this project has access to DNS-Operations Analysis and Research Center data, DNS Scanning Data, and CCZ traffic (Case Western's Case Connection Zone of 100 homes). As with much Internet technology, measurement is key to driving the evolution of protocols, services and operations. The second thrust involves proactively adding robustness to the DNS. The approach in this thrust is to design innovative mechanisms that anticipate problems by identifying where and when to share more information with more actors in the ecosystem. The final thrust leverages insight from previous measurement efforts and design mechanisms to improve intrinsic system robustness. As an example, the project considers restructuring the ecosystem by removing reliance on recursive DNS resolvers. New mechanisms developed in this project will be released to the community as extensions to current DNS tools (e.g., the bind DNS server).This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.