CT-ISG: Cooperative Security Mechanisms for DNS

域名系统（DNS）是互联网基础设施中非常有价值的组成部分，因为它为几乎所有主要的互联网应用程序提供了域名和IP地址之间的映射。不幸的是，DNS在设计时并没有考虑到安全性，并且存在许多漏洞。代理服务器的不安全性和DNS固有的层次结构使其容易受到中毒攻击。保护DNS操作的当代技术主要基于加密解决方案。在这个项目中，首席研究员（PI）正在研究提高DNS安全性的合作技术，作为DNSSEC中加密安全通信的替代方案。PI在域名交叉引用（DoX）方面的持续努力已经验证了基于合作的安全方法的潜在好处。利用这一努力，他专注于开发一个增强的框架，以防止对DNS的中毒攻击。该研究涵盖了多个领域，包括基于综合测量的合作安全评估、用于合作安全的对等组的选择和维护、通过分析建模定义和评估DNS服务质量指标，以及选择性使用加密技术使合作安全机制更加稳健。这些努力将有助于开发减少安全威胁的技术，例如对DNS的网络钓鱼、恶意攻击和拒绝服务攻击。在更广泛的影响背景下，拟议的研究将通过减少针对DNS的攻击和安全威胁，对互联网社区产生非常积极的影响。

CT-ISG: Cooperative Security Mechanisms for DNSThe Domain Name System (DNS) is a very valuable component in the Internet infrastructure as it provides a mapping between domain names and IP addresses for nearly all major Internet applications. Unfortunately, DNS was not designed with security in mind and has numerous vulnerabilities. Insecurity of the proxy servers and the inherent hierarchical structureof DNS makes it susceptible to the poisoning attacks. Contemporary techniques for securing DNS operations are predominantly based on cryptographic solutions. In this project, the Principal Investigator (PI) is examining cooperative techniques for enhancing security of DNS as an alternative to cryptographically secured communications as in DNSSEC. Ongoing efforts of the PI on the Domain Name Cross-referencing (DoX) have validated the potential benefits of the cooperation-based security approach. Leveraging on this effort, he is focusing on the development of an enhanced framework for guarding against the poisoning attacks on DNS.The research covers a variety of areas including a comprehensive measurement based evaluation of cooperative security, selection and maintenance of peer-groups used for cooperative security, definition and evaluation of DNS quality of service metrics through analytical modeling, and selective use of cryptographic techniques to make cooperative security mechanisms more robust. These efforts will help in developing techniques to reduce security threats such as phishing, pharming, and denial of service attacks on the DNS. In the context of broader impact, the proposed research will have a very positive impact on the Internet community in general by reducing the attacks and security threat against DNS.