CT-ISG: Collaborative Research: DNS Security Revisited: Enabling Cryptographic Defenses in Large-Scale Distributed Systems

建议：0524854标题：CT-ISG协作研究：重新审视：在大规模分布式系统中启用密码防御PI：张丽霞(加州大学洛杉矶分校)、松武路(加州大学洛杉矶分校)和丹·梅西(科罗拉多州)域名系统(DNS)是核心互联网协议，几乎所有互联网应用程序都依赖于某种形式的DNS数据。该项目正在确定和解决在全球互联网中部署域名系统安全扩展(DNSSEC)的基本技术挑战。DNSSEC旨在通过应用定义良好的加密解决方案来增强具有数据源身份验证和数据完整性检查的DNS，然而，在将加密解决方案转移到实际部署的过程中出现了一些系统问题。该项目首先对DNSSEC规范和部署限制之间的差距进行了系统评估。对于每个确定的技术挑战，该项目都会提出、实施和评估特定的解决方案，然后将这些解决方案整合到统一的设计改进中。DNSSEC的部署对于增强网络空间的安全至关重要，这一努力将通过克服现有障碍、预见道路上的新障碍以及开发使能技术来清除这些障碍来帮助推动DNSSEC向前发展。该项目还将推断一套关于在大规模系统中部署加密保护的主要挑战的经验教训和原则，希望这将为全球路由系统等其他加密部署工作提供投入。

Proposal: 0524854Title: CT-ISG Collaborative Research: DNS Security Revisited: Enabling Cryptographic Defenses in Large-Scale Distributed SystemsPIs: Lixia Zhang (UCLA), Songwu Lu (UCLA), and Dan Massey (Colorado State)The Domain Name System (DNS) is a core Internet protocol and virtually all Internet applications rely on some form of DNS data. This project is identifying and addressing fundamental technical challenges in deploying the DNS Security Extensions (DNSSEC) in the global Internet. DNSSEC aims at enhancing DNS with data origin authentication and data integrity checking by applying well defined cryptographic solutions, however a number of system issues have arisen in the process of moving the cryptographic solution to real deployment. This project is first conducting a systematic assessment of the gap between the DNSSEC specification and the deployment constraints. For each identified technical challenge, the project is proposing, implementing, and evaluating specific solutions and then integrating such solutions into a unified design improvement.DNSSEC deployment is critical to enhanced security in cyberspace, and this effort will help move it forward by overcoming existing roadblocks, foreseeing new obstacles on the road, and developing enabling techniques to clear these obstacles. The project will also extrapolate a set of lessons and principles on major challenges in deploying cryptographic protection in large scale systems, which will hopefully provide input into other cryptographic deployment effort, such as the global routing system.