DNS Update Extension to IPv6 Secure Addressing

Abstract

The Domain Name System (DNS) is a primary component of the Internet. It was for this reason that a DNS update mechanism was created and implemented giving hosts the ability to dynamically change DNS entries. But this new mechanism exposed DNS servers to new security vulnerabilities so some security protocols were introduced to address these issues. In Internet Protocol version 4 (IPv4), these mechanisms did resolve most security issues which concerned the authentication between a node and the DNS server while in Internet Protocol version 6 (IPv6) networks this became more difficult. This is due to the fact most protocols introduced to organize the large IPv6 address space do not support DNS authentication or have no option for secure DNS updating. We propose an extension to SEcure Neighbor Discovery (SEND) that will allow for updating DNS records dynamically at the same time that the host sets its IP address and sends its Neighbor Advertisement (NA) message announcing its IP to other nodes on the network. If the SEND-enabled DNS server is in the same local link, then the DNS server updates the DNS Resource Records (RRs) by listening to these NA messages. If not, we propose the use of a Controlling Node (CN) with which to communicate with the DNS server via common, secure DNS Update messages. This CN mediates between local link nodes and the DNS server.