Domain Name System Name Research Articles

Improved Resource Directory Based on DNS Name Self-Registration for Device Transparent Access in Heterogeneous IoT Networks

With the rapid development of Internet of Things (IoT) technologies in various domains including smart homes, smart cities, smart factories and smart buildings where Internet-connected devices are deployed to provide IoT services based on heterogeneous frameworks and platforms. Many standard protocols, frameworks, libraries and specifications have been proposed for developing IoT applications. Therefore, providing a consistent scheme is important for supporting the interoperability in heterogeneous IoT devices to interact in the same domain and cross-domain. Moreover, supporting the device transparent access for clients to consume IoT service from the different environment that can provide user-friendly service scenarios although the user consumes services in different IoT networks. In this paper, we propose an improved Resource Directory (RD) based on a Domain Name System (DNS) Name Self-Registration (DNSNSR) for the device transparent access in heterogeneous IoT networks. For supporting proposed DNSNSR, an IoT RD is presented based on the Open Connectivity Foundation (OCF) standard specification to provide device registration and discovery service. Through the registration interface, the IoT RD configures the DNS names using Bind 9 to provide the DNS service in an IoT network based on the published device information. Using the discovery interface of RD and name resolution of DNS, the IoT Client gets devices information including (Identifier) ID and Internet Protocol (IP) to access IoT Devices without considering underlying protocols through the interworking proxy of proposed RD in heterogeneous IoT networks. Therefore, the proposed RD based on DNSNSR enables the IoT devices to be discovered by IoT clients in the various environment through the RD and DNS functions. Furthermore, using the OCF-direct and proxy-based access mechanism, the proposed RD based on DNSNSR supports IoT devices to be accessed by clients in various IoT environment.

A framework for DNS naming services for Internet-of-Things devices

This paper proposes a new naming framework for Domain Name System (DNS) Name Autoconfiguration (called DNSNA) for Internet of Things (IoT) devices in Internet Protocol (IP) version 6 (IPv6) and IP version 4 (IPv4) networks. As the number of IoT devices increases, it can be a burden for users to manually configure the DNS names of the IoT devices. We propose DNSNA to provide an efficient DNS name management for IoT devices, supporting an IoT device’s DNS name auto-generation, its DNS name auto-registration, device discovery, and service discovery. A user can easily use the registered DNS information of the IoT devices for both device discovery and service discovery through DNSNA. DNSNA uses IPv6 Neighbor Discovery (ND) protocol for IPv6 IoT devices and Dynamic Host Configuration Protocol (DHCP) for IPv4 IoT devices, respectively, in the IoT DNS name autoconfiguration. With either ND or DHCP, the IoT devices can obtain a DNS suffix and construct their DNS name. Also, through a physical-contact-based authentication of a user’s smartphone with an IoT device over Near Field Communication (NFC), an authenticated IoT device can automatically register its DNS name and the corresponding IP address into a local authoritative DNS server in a secure way. Through real experiments and analysis, it is shown that DNSNA can reduce the average number of packets by 60.8% and the accumulated packet volume by 97% in comparison with the existing DNS naming service (i.e., mDNS) for IoT devices in an IPv6 network.

A High-Performance, Scalable Infrastructure for Large-Scale Active DNS Measurements

The domain name system (DNS) is a core component of the Internet. It performs the vital task of mapping human readable names into machine readable data (such as IP addresses, which hosts handle e-mail, and so on). The content of the DNS reveals a lot about the technical operations of a domain. Thus, studying the state of large parts of the DNS over time reveals valuable information about the evolution of the Internet. We collect a unique long-term data set with daily DNS measure-ments for all the domains under the main top-level domains (TLDs) on the Internet (including .com , .net , and .org , comprising 50% of the global DNS name space). This paper discusses the challenges of performing such a large-scale active measurement. These challenges include scaling the daily measurement to collect data for the largest TLD ( .com , with 123M names) and ensuring that a measurement of this scale does not impose an unacceptable burden on the global DNS infrastructure. The paper discusses the design choices we have made to meet these challenges and documents the design of the measurement system we implemented based on these choices. Two case studies related to cloud e-mail services illustrate the value of measuring the DNS at this scale. The data this system collects is valuable to the network research community. Therefore, we end this paper by discussing how we make the data accessible to other researchers.

사물인터넷 디바이스를 위한 DNS 네임 자동설정의 설계 및 구현

As one of the most spotlighted research areas, these days, the Internet of Things (IoT) aims to provide users with various services through many devices. Since there exist so many devices in IoT environments, it is inefficient to manually configure the domain name system (DNS) names of such devices. Thus, for IPv6-based IoT environments, this paper proposes a scheme called the DNS Name Autoconfiguration (DNSNA) that autoconfigures an IoT device's DNS name and manages it. In the procedure for generating and registering an IoT device's DNS name, the standard protocols of the Internet Engineering Task Force (IETF) are used. Since the proposed scheme resolves an IoT device's DNS name into an IPv6 address in unicast through a DNS server, it generates less traffic than multicast-based mDNS (Multicast DNS) which is a legacy DNS application for the DNS name service in the smart home. Thus, the proposed scheme is more appropriate in multi-hop IoT networks than mDNS. This paper explains the design of the proposed scheme and its service scenarios, such as smart home and smart road. It also explains the implementation and testing of the proposed scheme in the smart grid.

P-DONAS

The domain name system (DNS) includes infrastructures deployed by Internet service providers (ISPs) and third-party suppliers to ensure high responsiveness, resilience, and load sharing. This equipment implies high effort and energy for 24/7 operation. To facilitate cost reductions in this regard, P-DONAS—a peer-to-peer (P2P)-based DNS—organizes access nodes (ANs) of an ISP’s access network, which possess available resources, into a decentralized, self-organizing distributed hash table--based P2P network. Each AN acts as traditional DNS server and solely stores a piece of DNS data. DNS requests issued to an AN are resolved via P2P lookups while maintaining full compatibility with traditional DNS. The article discusses the application of P-DONAS as both a complement and an alternative to traditional DNS. Results from both simulations and a practical test arrangement prove P-DONAS’ high scalability and its performance comparable to that of a commercial DNS name server relieving this name server by 53% to 75% of DNS traffic.

The Internet of Names

The Domain Name System (DNS) is part of the core infrastructure of the Internet. Tracking changes in the DNS over time provides valuable information about the evolution of the Internet's infrastructure. Until now, only one large-scale approach to perform these kinds of measurements existed, passive DNS (pDNS). While pDNS is useful for applications like tracing security incidents, it does not provide sufficient information to reliably track DNS changes over time. We use a complementary approach based on active measurements, which provides a unique, comprehensive dataset on the evolution of DNS over time. Our high-performance infrastructure performs Internet-scale active measurements, currently querying over 50% of the DNS name space on a daily basis. Our infrastructure is designed from the ground up to enable big data analysis approaches on, e.g., a Hadoop cluster. With this novel approach we aim for a quantum leap in DNS-based measurement and analysis of the Internet.

Analysis of Flooding DoS Attacks Utilizing DNS Name Error Queries

The Domain Name System (DNS) is a critical Internet infrastructure that provides name to address mapping services. In the past decade, Denial-of-Service (DoS) attacks have targeted the DNS infrastructure and threaten to disrupt this critical service. While the flooding DoS attacks may be alleviated by the DNS caching mechanism, we show in this paper that flooding DoS attacks utilizing name error queries is capable of bypassing the cache of resolvers and thereby impose overwhelming flooding attacks on the name servers. We analyze the impacts of such DoS attacks on both name servers and resolvers, which are further illustrated by May 19 China’s DNS Collapse. We also propose the detection and defense approaches for protecting DNS servers from such DoS attacks. In the proposal, the victim zones and attacking clients are detected through monitoring the number of corresponding responses maintained in the negative cache. And the attacking queries can be mitigated by the resolvers with a sample proportion adaptive to the percent of queries for the existent domain names. We assess risks of the DoS attacks by experimental results. Measurements on the request rate of DNS name server show that this kind of attacks poses a substantial threat to the current DNS service.

Maintaining Strong Cache Consistency for the Domain Name System

Effective caching in the domain name system (DNS) is critical to its performance and scalability. Existing DNS only supports weak cache consistency by using the time-to-live (TTL) mechanism, which functions reasonably well in normal situations. However, maintaining strong cache consistency in DNS as an indispensable exceptional handling mechanism has become more and more demanding for three important objectives: 1) to quickly respond and handle exceptions such as sudden and dramatic Internet failures caused by natural and human disasters, 2) to adapt increasingly frequent changes of Internet Protocol (IP) addresses due to the introduction of dynamic DNS techniques for various stationed and mobile devices on the Internet, and 3) to provide fine-grain controls for content delivery services to timely balance server load distributions. With agile adaptation to various exceptional Internet dynamics, strong DNS cache consistency improves the availability and reliability of Internet services. In this paper, we first conduct extensive Internet measurements to quantitatively characterize DNS dynamics. Then, we propose a proactive DNS cache update protocol (DNScup), running as middleware in DNS name servers, to provide strong cache consistency for DNS. The core of DNScup is an optimal lease scheme, called dynamic lease, to keep track of the local DNS name servers. We compare dynamic lease with other existing lease schemes through theoretical analysis and trace-driven simulations. Based on the DNS dynamic update protocol, we build a DNScup prototype with minor modifications to the current DNS implementation. Our system prototype demonstrates the effectiveness of DNScup and its easy and incremental deployment on the Internet.

Secure Online DNS Dynamic Updates

Domain Name System (DNS) is the Internet infrastructure for mapping human-friendly domain names into IP addresses. To provide data-origin authentication for DNS, the DNS Security Extension (DNSSEC) standard was developed. In this article, we point out two drawbacks of DNSSEC in its handling of DNS dynamic updates: 1) creating a single point of attack with the on-line storage of a zone security key, and 2) violating the role separation principle by mixing up the roles of zone security managers and DNS name server administrators. To address these issues, we propose an alternative secure DNS architecture based on threshold cryptography. To demonstrate the feasibility of the proposed architecture, we developed a toolkit and built a proof-of-concept prototype. Our running results show that the performance of our architecture ranges from one to four times of DNSSEC’s performance. Thus, through small performance overhead, our architecture could achieve very high level of security.

ENUM: The Collision Of Telephony And DNS Policy

ENUM marks either the convergence or collision of the public telephone network with the Internet. ENUM is an innovation in the domain name system (DNS). It starts with numerical domain names that are used to query DNS name servers. The servers respond with address information found in DNS records. This can be telephone numbers, email addresses, fax numbers, SIP addresses, or other information. The concept is to use a single number in order to obtain a plethora of contact information. By convention, the Internet Engineering Task Force (IETF) ENUM Working Group determined that an ENUM number would be the same numerical string as a telephone number. In addition, the assignee of an ENUM number would be the assignee of that telephone number. But ENUM could work with any numerical string or, in fact, any domain name. The IETF is already working on using E.212 numbers with ENUM. ENUM creates multiple policy problems. What impact does ENUM have upon the public telephone network and the telephone numbering resource? For example, does this create a solution or a problem for number portability? If ENUM truly is a DNS innovation, how does it square with the classic difficulties experienced with DNS and ICANN? Is ENUM, while presenting a convergence solution, also encumbered with the policy problems of both the DNS and telephony worlds? IETF ENUM proponents suggest that ENUM needs a single unified database administered through national and international government sanctioned monopolies. The IETF took the unusual step of requesting that the International Telecommunications Union (ITU) regulate an aspect of the Internet, that is, participate and have authority over the international ENUM service provider. But this notion of establishing a new communications monopoly collides with the deregulatory efforts of the Telecommunications Act of 1996, the attempts to privatize DNS through ICANN, and US policy that the Internet should be left unregulated. ENUM is an unproven innovation with no evidence of commercial viability. It faces a strongly competitive market of other directory assistance innovations and services. Proponents are asking governments to sanction one competitor over others. ENUM offers two lessons. First, involving the government in a standards process is fraught with problems and delays. It starts with the cliche of having too many cooks in the kitchen, producing a mediocre cake at best. And it ends with a cumbersome bureaucratic process resulting in fatal delay and ultimately collapsing in upon itself. Similar efforts in the past rose to grandiose levels and failed. These include X.500 and OSI. Second, a number by any other name remains a number. A significant portion of the DNS wars has been focused on resolving who has the right to a name. Is it first come, first serve, a trademark holder, someone using the domain name pursuant to free speech rights, or perhaps some other right? With ENUM, the question presented is who has the right to a numerical string. ENUM attempts to resolve this question by convention, concluding that the assignee of a telephone number has rights to an ENUM number. But an ENUM number is not a telephone number. A telephone number is an address used on a telephone network to reach a telephone. An ENUM number is a token used to access a database. Transferring a numerical string from one context to another does not likewise transfer the rules and regulations of the original context. Rules and regulations created for telephone numbers assume a particular purpose in a particular context; they do not apply to numerical strings in a foreign context with a different purpose. It is illogical and dangerous to transfer the policy concerning one type of number to a different type of number. This means, among other things, that the regulatory authority over telephone numbers has no more jurisdiction over ENUM numbers then when telephone numbers are used to rent videos or access savings clubs at the grocery store. US policy has been to keep information technology unregulated to permit it to innovate at the speed of the market and not at the pace of bureaucracy. Yet ENUM proponents beg for government entanglement. It would be unprecedented for the government to sanction a monopoly for something as unproven as ENUM where the appropriateness of a government monopoly has not been demonstrated. Were such government involvement in fact approved, the delay experienced would likely be fatal to the innovation. There are those who are strong advocates of an ENUM unified database. An ENUM unified database can likely be achieved by private industry through some level of a joint venture devoid of government entanglement. This is the best hope for ENUM achieving the goal of a swift implementation.

Arguments for Recalling WIPO RFC3

The Internet Domain Name System (DNS) allows a user to associate a name with a resource on the Internet, such as a machine, an electronic mail address, or a Web site. Trademarks exist in another, more traditional, name system which permits a customer to associate a product name with an enterprise, the mark owner. This paper argues that DNS names are intersubjective and never objective, while trademarks are objective and may also be intersubjective. These basic differences between a DNS name and a trademark name were however fully ignored by the World Intellectual Property Organization (WIPO) report RFC3, which seeks to regulate worldwide Internet domain names in purely objective terms. This paper further demonstrates that conflicts between the two naming systems exist in the intersubjective arena but are less than 0.04% for a typical well-known mark in a period of nine months. These results suggest that WIPO's RFC3 is basically flawed in motivation, qualification, and method, so that it should be recalled in totum. Its application would more probably cause more difficulties to Internet users and trademark owners than the few confusing cases it may avoid. A solution to these problems may be found in digital identity certification or at least origin authentication. "Business server certificates" - based on cryptographic challenge-response - can concretely define an objective business identifier on the Internet and can be used to support trademark requirements. Other issues such as cybersquatting, anonymity in DNS registration and tracing and stopping trademark-infringement sites are also treated in this paper.