Domain Name System Infrastructure Research Articles

DNS for IoT: A Survey.

The Internet of Things (IoT) is paving the way to becoming necessary in numerous aspects of people's lives. IoT is becoming integrated in many domains, such as medical, industrial, and personal. Recent years have witnessed the creation of many IoT technologies that differ not only in their applications and use cases but also in standards. The absence of universally accepted standards and the variety of technologies are only some challenges the IoT market faces. Other challenges include the constrained nature of most IoT devices, the diverse identification schemes, the inadequate security mechanisms, and the lack of interoperability between different technologies. The Domain Name System (DNS) persisted throughout the years as the Internet's naming service and accumulated more trust from users with the introduction of its security extensions. DNS could be utilized to address some of the challenges the IoT market faces. However, using DNS for IoT applications might jeopardize DNS infrastructure. In this survey, we study the coexistence of DNS and IoT. We define IoT, present its architecture and discuss its main challenges. We then introduce DNS and its function; we discuss its security and privacy drawbacks and the extensions standardized to address them. We further discuss the uses of DNS in IoT environments to address some of IoT's challenges and the impact these uses might have on DNS.

A Light-Weight Statistical Latency Measurement Platform at Scale

The statistical value of latencies between two sets of hosts over a given period, which is referred as to the statistical latency, can benefit many applications in the next-generation networks, for example, Network-in-a-Box-based resource provisioning. However, the existing methods can hardly achieve low measurement cost and high prediction accuracy simultaneously in large-scale scenarios. In this article, we design a light-weight statistical latency measurement platform named DMS (DNS-based statistical latency Measurement platform at Scale). DMS achieves high measurement accuracy by introducing a metric space to select the closest open recursive DNS (Domain Name System) server to a given host, and predicting the end-to-end latency between two hosts via the measured latency between the two corresponding DNS servers. To reduce the overall measurement overhead, DMS clusters the hosts in the metric space with the open recursive DNS infrastructure in the network as the cluster center, thus achieving low measurement cost and good scalability in large scale simultaneously. To evaluate the performance of DMS, we implement a prototype system in the network. Compared to the widely adopted method King, DMS can reduce the relative error by 18.5% for real-time end-to-end latency prediction and 33% for statistical latency prediction.

DNS-embedded service endpoint registry for distributed e-Infrastructures

Distributed e-Infrastructure is a key component of modern BIG Science. Service discovery in e-Science environments, such as Worldwide LHC Computing Grid (WLCG), is a crucial functionality that relies on service registry. In this paper we re-formulate the requirements for the service endpoint registry based on our more than 10 years experience with many systems designed or used within the WLCG e-Infrastructure. To satisfy those requirements the paper proposes a novel idea to use the existing well-established Domain Name System (DNS) infrastructure together with a suitable data model as a service endpoint registry. The presented ARC Hierarchical Endpoints Registry (ARCHERY) system consists of a minimalistic data model representing services and their endpoints within e-Infrastructures, a rendering of the data model embedded into DNS-records, a lightweight software layer for DNS-record management and client-side data discovery. Our approach for the ARCHERY registry required minimal software development and inherits all the benefits of one of the most reliable distributed information discovery source of the internet, the DNS infrastructure. In particular, deployment, management and operation of ARCHERY is fully relying on DNS. Results of ARCHERY deployment use-cases are provided together with performance analysis.

Domain name system security and privacy: A contemporary survey

The Domain Name System (DNS) is one of the most important components of today’s Internet, and is the standard naming convention between human-readable domain names and machine-routable Internet Protocol (IP) addresses of Internet resources. However, due to the vulnerability of DNS to various threats, its security and functionality have been continuously challenged over the course of time. Although, researchers have addressed various aspects of the DNS in the literature, there are still many challenges yet to be addressed. In order to comprehensively understand the root causes of the vulnerabilities of DNS, it is mandatory to review the various activities in the research community on DNS landscape. To this end, this paper surveys more than 170 peer reviewed papers, which are published in both top conferences and journals in last ten years, and summarizes vulnerabilities in DNS and corresponding countermeasures. This paper not only focuses on the DNS threat landscape and existing challenges, but also discusses the utilized data analysis methods, which are frequently used to address DNS threat vulnerabilities. Furthermore, we looked into the DNS threat landscape from the view point of the involved entities in the DNS infrastructure in an attempt to point out more vulnerable entities in the system.

Privacy-Preserving Passive DNS

The Domain Name System (DNS) was created to resolve the IP addresses of web servers to easily remembered names. When it was initially created, security was not a major concern; nowadays, this lack of inherent security and trust has exposed the global DNS infrastructure to malicious actors. The passive DNS data collection process creates a database containing various DNS data elements, some of which are personal and need to be protected to preserve the privacy of the end users. To this end, we propose the use of distributed ledger technology. We use Hyperledger Fabric to create a permissioned blockchain, which only authorized entities can access. The proposed solution supports queries for storing and retrieving data from the blockchain ledger, allowing the use of the passive DNS database for further analysis, e.g., for the identification of malicious domain names. Additionally, it effectively protects the DNS personal data from unauthorized entities, including the administrators that can act as potential malicious insiders, and allows only the data owners to perform queries over these data. We evaluated our proposed solution by creating a proof-of-concept experimental setup that passively collects DNS data from a network and then uses the distributed ledger technology to store the data in an immutable ledger, thus providing a full historical overview of all the records.

Load Distributed and Benign-Bot Mitigation Methods for IoT DNS Flood Attacks

A domain name system (DNS) is one of the most important infrastructures of the Internet communication. It is also a crucial point which is subjected to attacks. The largest distributed denial-of-service (DDoS) attack on October 21, 2016 has targeted a major DNS infrastructure named dynDNS. It was actually the Internet of Things (IoT) DNS flood attack that made more than half of websites in the United States unreachable for a significant amount of time. As we are using the Internet for everything in our life, especially health care and transportation, an attack of this type may cause a major disruption. Therefore, in this article, we are going to analyze the DNS flood attacks and propose two mitigation methods. We propose a load distributed mitigation process which will work as a quick escape route of the legitimate traffic from the attack field. Our solution mainly involves service level changes which can be implemented with collaboration among service providers. Also, our proposed solution is very cost effective as compared to the cost of downtime of the domain names caused by a DNS flood attack. Furthermore, we propose a benign-bot mitigation method and a business model for the method. In the benign-bot mitigation method, a bot program is installed in customers' DNS local servers to allow IP addresses of a list of paid businesses' websites to maintain in the caches so that the websites can be accessed even when the DNS servers are down.

Oblivious DNS: Practical Privacy for DNS Queries

Abstract Virtually every Internet communication typically involves a Domain Name System (DNS) lookup for the destination server that the client wants to communicate with. Operators of DNS recursive resolvers—the machines that receive a client’s query for a domain name and resolve it to a corresponding IP address—can learn significant information about client activity. Past work, for example, indicates that DNS queries reveal information ranging from web browsing activity to the types of devices that a user has in their home. Recognizing the privacy vulnerabilities associated with DNS queries, various third parties have created alternate DNS services that obscure a user’s DNS queries from his or her Internet service provider. Yet, these systems merely transfer trust to a different third party. We argue that no single party ought to be able to associate DNS queries with a client IP address that issues those queries. To this end, we present Oblivious DNS (ODNS), which introduces an additional layer of obfuscation between clients and their queries. To do so, ODNS uses its own authoritative namespace; the authoritative servers for the ODNS namespace act as recursive resolvers for the DNS queries that they receive, but they never see the IP addresses for the clients that initiated these queries. We present an initial deployment of ODNS; our experiments show that ODNS introduces minimal performance overhead, both for individual queries and for web page loads. We design ODNS to be compatible with existing DNS protocols and infrastructure, and we are actively working on an open standard with the IETF.

Measuring the Global Recursive DNS Infrastructure: A View From the Edge

The Domain Name System (DNS) is one of the most critical Internet subsystems. While the majority of ISPs deploy and operate their own DNS infrastructure, many end users resort to third-party DNS providers with hopes of enhancing their privacy, security, and web performance. However, bad user choices and the uneven geographical deployment of DNS providers could render insecure and inefficient DNS configurations for millions of users. In this paper, we propose a novel and flexible measurement method to (1) study the infrastructure of recursive DNS resolvers, including both ISP's and third-party DNS providers' deployment strategies; and (2) study end-user DNS choices, both in a timely manner and at a global scale. For that, we leverage the outreach capacity of online advertising networks to distribute lightweight JavaScript-based DNS measurement scripts. To showcase the potential of our technique, we launch two separate ad campaigns that triggered more than 3M DNS lookups, which allow us to identify and study more than 76k recursive DNS resolvers giving support to more than 25k eyeball ASes in 178 countries. The analysis of the data offers new insights into the DNS infrastructure, such as user preferences towards third-party DNS providers (namely, Google, OpenDNS, Level3, and Cloudflare recursive DNS resolvers account for ~13% of the total DNS requests triggered by our campaigns), and into deployment decisions of many ISPs providing both mobile and fixed access networks to separate the DNS infrastructure serving each type of access technology.

Resilience of the Domain Name System: A case study of the .nl-domain

In this paper we analyse the resilience of the Domain Name System (DNS). We study the impact on the availability of DNS data of certain domains for the users of the Internet when parts of the DNS infrastructure become unavailable. We perform our analysis on the level of autonomous systems and hence we explore the impact when an autonomous system (and all the routers, name servers and resolvers located in it) fails or when interconnections between autonomous systems fail. We provide a generic method to carry out this resilience analysis, in which we first identify the domain names within the analysed domain, the autonomous systems where the name servers and resolvers for this domain reside, and the interconnections and relations between these autonomous systems. Next, we simulate failure scenarios to analyse the impact on the reachability of autonomous systems and the corresponding DNS data when autonomous systems or connections between them become unavailable. Our method can identify bottlenecks and single points of failure that should be mitigated in order to improve resilience. We demonstrate our method in a case study for the .nl-domain and its underlying second-level domains.

Leakage of .onion at the DNS Root: Measurements, Causes, and Countermeasures

The Tor hidden services, one of the features of the Tor anonymity network, are widely used for providing anonymity to services within the Tor network. Tor uses the .onion pseudo-top-level domain for naming convention and to route requests to these hidden services. The .onion namespace is not delegated to the global domain name system (DNS), and Tor is designed in such a way that all .onion queries are routed within the Tor network. However, and despite the careful design of Tor, numerous .onion requests are still today observed in the global DNS infrastructure, thus calling for further investigation. In this paper, we present the state of .onion requests received at the global DNS and as viewed from two large DNS traces: a continuous period of observation at the A and J DNS root nodes over a longitudinal period of time and a synthesis of Day In The Life of the Internet data repository that gathers a synchronized DNS capture of two days per year over multiple years. We found that .onion leakage in the DNS infrastructure to be both prevalent and persistent. Our characterization of the leakage shows various features, including high volumes of leakage that are diverse, geographically distributed, and targeting various types of hidden services. Furthermore, we found that various spikes in the .onion request volumes can be correlated with various global events, including geopolitical events. We attribute the leakage to various causes that are plausible based on various assessments, and provide various remedies with varying benefits.

A High-Performance, Scalable Infrastructure for Large-Scale Active DNS Measurements

The domain name system (DNS) is a core component of the Internet. It performs the vital task of mapping human readable names into machine readable data (such as IP addresses, which hosts handle e-mail, and so on). The content of the DNS reveals a lot about the technical operations of a domain. Thus, studying the state of large parts of the DNS over time reveals valuable information about the evolution of the Internet. We collect a unique long-term data set with daily DNS measure-ments for all the domains under the main top-level domains (TLDs) on the Internet (including .com , .net , and .org , comprising 50% of the global DNS name space). This paper discusses the challenges of performing such a large-scale active measurement. These challenges include scaling the daily measurement to collect data for the largest TLD ( .com , with 123M names) and ensuring that a measurement of this scale does not impose an unacceptable burden on the global DNS infrastructure. The paper discusses the design choices we have made to meet these challenges and documents the design of the measurement system we implemented based on these choices. Two case studies related to cloud e-mail services illustrate the value of measuring the DNS at this scale. The data this system collects is valuable to the network research community. Therefore, we end this paper by discussing how we make the data accessible to other researchers.

DNSSEC for cyber forensics

Domain Name System (DNS) cache poisoning is a stepping stone towards advanced (cyber) attacks. DNS cache poisoning can be used to monitor users’ activities for censorship, to distribute malware and spam and to subvert correctness and availability of Internet clients and services. Currently, the DNS infrastructure relies on challenge-response defences against attacks by (the common) off-path adversaries. Such defences do not suffice against stronger, man-in-the-middle (MitM), adversaries. However, MitM is not believed to be common; hence, there seems to be little motivation to adopt systematic, cryptographic mechanisms. We show that challenge-response do not protect against cache poisoning. In particular, we review common situations where (1) attackers can frequently obtain MitM capabilities and (2) even weaker attackers can subvert DNS security. We also experimentally study dependencies in the DNS infrastructure, in particular, dependencies within domain registrars and within domains, and show that multiple dependencies result in more vulnerable DNS. We review domain name system security extensions (DNSSEC), the defence against DNS cache poisoning, and argue that not only it is the most suitable mechanism for preventing cache poisoning but it is also the only proposed defence that enables a posteriori forensic analysis of attacks.

A CDN-based Domain Name System

To enhance end-user experiences, Content Distribution Networks (CDNs) effectively exploit the Domain Name System (DNS) to redirect end-users to close-by content replicas over short time scales. While the use of DNS has brought a significant advantage to CDNs, in this paper we confirm that reliance on DNS also poses a fundamental threat to large-scale CDNs’ content distribution model. In particular, we demonstrate that a considerable penetration of public DNS resolving services (e.g., OpenDNS and GoogleDNS) effectively corrupts the CDN approach, equally the large-scale server distribution and quick DNS redirections. Our contributions are threefold. First, we systematically evaluate and quantify how the use of public DNS resolving services impacts Akamai’s content distribution model, the corresponding end-user service performance, and ISPs that host CDN edge servers. Second, we show that a CDN-based DNS architecture, which can effectively function as both the current authoritative nameservers and resolvers, coexist with the current DNS infrastructure, and directly response end-users with authoritative DNS records. Third, we implement a prototype CDN-based DNS system by using popular Web 2.0 websites as a vehicle to publish DNS records onto CDN edge servers. We demonstrate that in an extreme setting, such an approach can achieve one order of magnitude faster lookup times relative to existing DNS resolving systems. Most importantly, we argue that the proposed design provides a realistic way to change DNS and address a number of long-lasting and emerging problems associated with this basic Internet service.

A Proxy View of Quality of Domain Name Service, Poisoning Attacks and Survival Strategies

The Domain Name System (DNS) provides a critical service for the Internet -- mapping of user-friendly domain names to their respective IP addresses. Yet, there is no standard set of metrics quantifying the Quality of Domain Name Service (QoDNS), let alone a thorough evaluation of it. This article attempts to fill this gap from the perspective of a DNS proxy/cache, which is the bridge between clients and authoritative servers. We present an analytical model of DNS proxy operations that offers insights into the design trade-offs of DNS infrastructure and the selection of critical DNS parameters. Due to the critical role DNS proxies play in QoDNS, they are the focus of attacks including cache poisoning attack. We extend the analytical model to study DNS cache poisoning attacks and their impact on QoDNS metrics. This analytical study prompts us to present Domain Name Cross-Referencing (DoX), a peer-to-peer systems for DNS proxies to cooperatively defend cache poisoning attacks. Based on QoDNS, we compare DoX with the cryptography-based DNS Security Extension (DNSSEC) to understand their relative merits.

Analysis of Flooding DoS Attacks Utilizing DNS Name Error Queries

The Domain Name System (DNS) is a critical Internet infrastructure that provides name to address mapping services. In the past decade, Denial-of-Service (DoS) attacks have targeted the DNS infrastructure and threaten to disrupt this critical service. While the flooding DoS attacks may be alleviated by the DNS caching mechanism, we show in this paper that flooding DoS attacks utilizing name error queries is capable of bypassing the cache of resolvers and thereby impose overwhelming flooding attacks on the name servers. We analyze the impacts of such DoS attacks on both name servers and resolvers, which are further illustrated by May 19 China’s DNS Collapse. We also propose the detection and defense approaches for protecting DNS servers from such DoS attacks. In the proposal, the victim zones and attacking clients are detected through monitoring the number of corresponding responses maintained in the negative cache. And the attacking queries can be mitigated by the resolvers with a sample proportion adaptive to the percent of queries for the existent domain names. We assess risks of the DoS attacks by experimental results. Measurements on the request rate of DNS name server show that this kind of attacks poses a substantial threat to the current DNS service.

Quantifying DNS namespace influence

Name resolution using the Domain Name System (DNS) is integral to today’s Internet. The resolution of a domain name is often dependent on namespace outside the control of the domain’s owner. In this article we review the DNS protocol and several DNS server implementations. Based on our examination, we propose a formal model for analyzing the name dependencies inherent in DNS. Using our name dependency model we derive metrics to quantify the extent to which domain names affect other domain names. It is found that under certain conditions, more than half of the queries for a domain name are influenced by namespaces not expressly configured by administrators. This result serves to quantify the degree of vulnerability of DNS due to dependencies that administrators are unaware of. When we apply metrics from our model to production DNS data, we show that the set of domains whose resolution affects a given domain name is much smaller than previously thought. However, behaviors such as using cached addresses for querying authoritative servers and chaining domain name aliases increase the number and diversity of influential domains, thereby making the DNS infrastructure more vulnerable.

Open Issues in Secure Domain Name System (DNS) Deployment

The Domain Name System (DNS) is the primary infrastructure component of the Internet as it translates easy-to-remember Internet destination (web pages, mail servers) addresses (called URLs) into actual network addresses (IP addresses). Being the foundational technology for the Global economy, the DNS needs protection using state of practice security measures. A set of security specifications called DNS Security Extensions (DNSSEC) specification has been proposed by IETF and has been demonstrated to provide the needed protection. However ubiquitous DNSSEC deployment throughout the DNS infrastructure calls for certain critical security operations. There are some unresolved issues with respect to the rollout of these operations in terms of specification gaps, consensus security procedures and operational challenges. This article discusses those issues and provides some directions for resolving them.