CAREER: Securing and Evolving Internet Security Protocols for Naming and Routing

互联网的命名依赖于域名系统（DNS）。DNSSEC （Security Extensions of DNS）和RPKI （Resource Public Key Infrastructure）为互联网的两个关键方面提供了安全保障：通过DNSSEC进行命名和通过RPKI进行BGP路由。尽管RPKI和DNSSEC具有关键的重要性，但考虑到它们的复杂性和在不同实体中部署和实施的不同方式，充分掌握RPKI和DNSSEC的原理并安全有效地管理它们是一项挑战。这个项目旨在提高互联网基础设施的这些基本组件的可见性、理解、管理和安全性。该项目有三个主要目标。首先，它介绍了一种大规模评估DNS和RPKI客户端的技术，利用住宅虚拟专用网（VPN）代理和扰动技术（如模糊和遗传算法）来精确定位和解决安全漏洞。其次，它计划从管理员的角度分析配置错误的原因，旨在创建基于机器学习的工具来自动纠正错误。最后，它计划利用RPKI和DNSSEC来提高其他网络协议的安全性，重点关注TLS撤销信任问题和关键基础设施通信通道的安全评估。通过为DNSSEC和RPKI提供更清晰的理解和有效的管理工具，该项目解决了确保互联网仍然是一个安全和值得信赖的环境的根本挑战。这对于维护互联网命名和路由的完整性和可靠性非常重要，而互联网命名和路由是全球数字生态系统的基础。该项目的成果将有助于最大限度地减少管理不善和漏洞，从而提高互联网的整体安全性和弹性。该项目的资源，包括工具、数据集和源代码，将在https://projects.netsecurelab.org上提供，确保对互联网安全感兴趣的研究人员、从业人员和政策制定者可以长期访问。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Internet's naming relies on the Domain Name System (DNS). Security Extensions of DNS (DNSSEC) and Resource Public Key Infrastructure (RPKI) safeguard the Internet's two critical aspects: naming through DNSSEC and routing through Border Gateway Protocol (BGP) using RPKI. Despite their pivotal importance, fully grasping the principles of RPKI and DNSSEC and managing them securely and effectively presents challenges, given their complexity and the diverse ways they are deployed and implemented across various entities. This project aims to improve the visibility, understanding, administration, and security of these essential components of Internet infrastructure.The project targets three main objectives. Firstly, it introduces a technique for evaluating DNS and RPKI clients at scale, leveraging residential virtual private network (VPN) proxies and perturbation techniques such as fuzzing and genetic algorithms to pinpoint and address security vulnerabilities. Secondly, it plans to analyze the causes of configuration errors from administrators' viewpoints, aiming to create machine learning-based tools for automatic correction of errors. Lastly, it plans to leverage RPKI and DNSSEC to improve the security of other network protocols, focusing on TLS revocation trust issues and the security assessment of critical infrastructure communication channels.By providing a clearer understanding and effective management tools for DNSSEC and RPKI, the project addresses fundamental challenges in ensuring the Internet remains a secure and trustworthy environment. This is important for maintaining the integrity and reliability of Internet naming and routing, which are foundational to the global digital ecosystem. The project's outcomes will be to help minimize mismanagement and vulnerabilities, towards enhancing the overall security and resilience of the Internet.The project's resources, including tools, datasets, and source code, will be made available at https://projects.netsecurelab.org, ensuring long-term access for researchers, practitioners, and policymakers interested in Internet security.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.