Resolving islands of security problem for DNSSEC

ABSTRACT

The DNS Security Extensions (DNSSEC) were developed to add origin authentication and integrity. DNSSEC defined a public key infrastructure over DNS tree hierarchy for the public key validation. In DNSSEC, a parent zone authenticates public keys of its child zones. The authentication hierarchy is broken when a parent does not support DNSSEC. This paper proposes an effective mechanism to overcome this partial deployment problem. Our solution uses a public bulletin board for zones to post their DNSKEY information. Resolvers use posted key information to find key authentication chains that can be used to validate the DNSKEY. Bulletin Board(BB) provides complete trust relationship information when the key authentication hierarchy is broken, and distributes the complete key information even when false zones provide the invalid keys. The bulletin board does not guarantee the correctness of DNSKEY information, but it does guarantee the completeness of the key information. Our approach helps DNS zones to deploy DNSSEC even when their parent zones do not deploy DNSSEC, and it does not require any changes to the current DNSSEC protocol and the existing software.

REFERENCES

• 1: DNSSEC in .NL. http://www.nlnetlabs.nl/dnssec.
• 2: DNSSEC in .SE. http://dnssec.nic-se.se.
• 3: Marc Horowitz, PGP public key serve. http://www.mit.edu/people/marc/pks, 1997.
• 4: John P. Jones , Daniel F. Berger , Chinya V. Ravishankar, Layering Public Key Distribution Over Secure DNS using Authenticated Delegation, Proceedings of the 21st Annual Computer Security Applications Conference, p.409-418, December 05-09, 2005 [doi>10.1109/CSAC.2005.35]
• 5: Matt Blaze , Joan Feigenbaum , Jack Lacy, Decentralized Trust Management, Proceedings of the 1996 IEEE Symposium on Security and Privacy, p.164, May 06-08, 1996
• 6: Paul Resnick , Ko Kuwabara , Richard Zeckhauser , Eric Friedman, Reputation systems, Communications of the ACM, v.43 n.12, p.45-48, Dec. 2000 [doi>10.1145/355112.355122]
• 7: Patrick McDaniel and Sugih Jamin. A Scalable Key Distribution Hierarchy. In Technical Report, Electrical Engineering and Computer Science, University of Michigan, pages CSE-TR-366--98, 1998.
• 8: Philip R. Zimmermann, The official PGP user's guide, MIT Press, Cambridge, MA, 1995
• 9: R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. DNS Security Introduction and Requirements, March 2005.
• 10: Russ Cox , Athicha Muthitacharoen , Robert Morris, Serving DNS Using a Peer-to-Peer Lookup Service, Revised Papers from the First International Workshop on Peer-to-Peer Systems, p.155-165, March 07-08, 2002

INDEX TERMS

Primary Classification:
  E. Data
  E.3 DATA ENCRYPTION

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)
  C.4 PERFORMANCE OF SYSTEMS

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Authentication

General Terms:
Algorithms, Security

Keywords:
DNS security, authentication chains, bulletin board, key authentication, key distribution, sanity check, starting points, trust relationship