DNSSEC自动化部署相关问题分析

doi:10.11959/j.issn.2096-109x.2017.00155

网络与信息安全学报 ›› 2017, Vol. 3 ›› Issue (3): 58-63.doi: 10.11959/j.issn.2096-109x.2017.00155

DNSSEC自动化部署相关问题分析

郭川,冷峰

中国互联网络信息中心，北京 100190

修回日期:2017-02-09 出版日期:2017-03-01 发布日期:2017-03-25
作者简介:郭川（1988-），男，河北石家庄人，硕士，中国互联网络信息中心系统工程师，主要研究方向为域名系统安全。|冷峰（1982-），男，山东烟台人，中国互联网络信息中心规划工程师，主要研究方向为域名服务平台优化和域名系统安全。

Analysis of problems in the DNSSEC automation deployment

Chuan GUO,Feng LENG

China Internet Network Information Center,Beijing 100190,China

Revised:2017-02-09 Online:2017-03-01 Published:2017-03-25

摘要/Abstract

摘要：

基于国家顶级域名系统安全扩展协议部署实践，总结了域名系统安全扩展协议发展背景，分析了域名系统安全扩展协议当前应用现状，提出并分析了域名系统安全扩展协议部署中的自动化问题，总结并分析了在生产环境中部署实施域名系统安全扩展协议时所需要注意的若干问题。

关键词: 域名系统, 域名系统安全, 域名系统安全扩展协议, 自动化部署

Abstract:

Based on the practice of domain name system security extensions protocols' deployment in country code top-level domain,the development background of the domain name system security extensions protocols were summarized,the current applications of the domain name system security extensions protocols were analyzed,the automation problems in the domain name system security extensions protocols' deployment were put forward and analyzed,several issues that need to be addressed when deploying the domain name system security extensions protocols in the production environment were summarized and analyzed.

Key words: domain name system, DNS security, DNSSEC protocol, DNSSEC automation

中图分类号:

TP393

郭川,冷峰. DNSSEC自动化部署相关问题分析[J]. 网络与信息安全学报, 2017, 3(3): 58-63.

Chuan GUO,Feng LENG. Analysis of problems in the DNSSEC automation deployment[J]. Chinese Journal of Network and Information Security, 2017, 3(3): 58-63.

图/表 4

参考文献 16

[1]	BELLOVIN S M , . Using the domain name system for system break-ins[C]// Usenix Unix Security Symposium. 1996.
[2]	SCHUBA C L , SPAFFORD E H . Addressing weaknesses in the domain name system protocol[D]. Indiana:Purdue University, 1994.
[3]	VIXIE P , . DNS and BIND security issues[C]// Usenix Unix Security Symposium. 1995: 263-279.
[4]	EASTLAKE D . RFC 2065:domain name system security extensions[S]. RFC IETF, 1997.
[5]	EASTLAKE D . RFC 2535:domain name system security extensions[S]. RFC IETF, 1999.
[6]	AUSTEIN R . RFC 3833:threat analysis of the domain name system[S]. RFC IETF, 2004.
[7]	US-CERT.Multiple DNS implementations vulnerable to cache poisoning[EB/OL]. .
[8]	LAURIE B , SISSON G , ARENDS R ,et al. RFC5155:DNS security(DNSSEC)hashed authenticated denial of existence[S]. RFC IETF, 2008.
[9]	AUSTEIN R , LARSON M . RFC 4033:DNS security introduction and requirements[S]. RFC IETF, 2005.
[10]	ARENDS R , AUSTEIN R , LARSON M ,et al. RFC4034:resource records for the DNS security extensions[S]. RFC IETF, 2005.
[11]	ARENDS R , AUSTEIN R , LARSON M ,et al. RFC4035:protocol modifications for the DNS security extensions[S]. RFC IETF, 2005.
[12]	YANG H , OSTERWEIL E , MASSEY D ,et al. Deploying cryptography in internet-scale systems:a case study on DNSSEC[J]. IEEE Transactions on Dependable ＆ Secure Computing, 2010,8(5): 656-669.
[13]	KOLKMAN O , GIEBEN R . RFC4641:DNSSEC operational practices[S]. RFC IETF, 2006.
[14]	STJOHNS M . RFC5011:automated updates of dns security(DNSSEC)trust anchors[S]. RFC IETF, 2007.
[15]	LAURIE B , SISSON G , ARENDS R ,et al. RFC5155:DNS security(DNSSEC)hashed authenticated denial of existence[S]. RFC IETF, 2003.
[16]	GIEBEN R , MEKKING W . RFC7129:authenticated denial of existence in the DNS[S]. RFC IETF, 2014.

DNSSEC自动化部署相关问题分析

Analysis of problems in the DNSSEC automation deployment

在线阅读

pdf下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 4

参考文献 16

相关文章 2

Metrics

推荐阅读 0

[1]	胡杨, 韩增杰, 叶帼华, 姚志强. 基于无证书签名的抗DNS中间人攻击方案[J]. 网络与信息安全学报, 2021, 7(6): 167-177.
[2]	王翠翠,延志伟,耿光刚. 互联网名址体系安全保障技术及其应用分析[J]. 网络与信息安全学报, 2017, 3(3): 34-42.