在DNSSEC下保障顶级域名解析托管服务稳定迁移的操作机制

doi:10.11959/j.issn.2096-109x.2021059

网络与信息安全学报 ›› 2021, Vol. 7 ›› Issue (3): 156-165.doi: 10.11959/j.issn.2096-109x.2021059

在DNSSEC下保障顶级域名解析托管服务稳定迁移的操作机制

何峥, 冷峰, 张翠玲

中国互联网络信息中心，北京 100190

修回日期:2020-12-18 出版日期:2021-06-15 发布日期:2021-06-01
作者简介:何峥（1978- ），男，北京人，中国互联网络信息中心高级工程师，主要研究方向为域名系统运行与安全
冷峰（1982- ），男，山东莱阳人，博士，中国互联网络信息中心高级工程师，主要研究方向为域名服务平台优化和域名系统安全
张翠玲（1982- ），女，山东胶南人，中国互联网络信息中心高级工程师，主要研究方向为域名系统运行与安全
基金资助:
北京市科技新星计划项目(Z191100001119113)

Operation mechanism for ensuring the stable migration of top-level domain name resolution hosting services with DNSSEC

Zheng HE, Feng LENG, Cuiling ZHANG

China Internet Network Information Center, Beijing 100190, China

Revised:2020-12-18 Online:2021-06-15 Published:2021-06-01
Supported by:
Beijing Nova Program of Science and Technology(Z191100001119113)

摘要/Abstract

摘要：

基于顶级域解析服务托管平台迁移部署实践，重点研究分析了在DNSSEC环境下，为避免发生域名系统安全扩展（DNSSEC，DNS security extension）信任链及解析服务中断、域名NS记录不一致等安全问题，如何在密钥轮转、DS 和 NS 记录变更、数据更新等环节中实现新旧服务托管商及互联网数字分配机构（IANA，internet assigned numbers authority）之间进行解析服务平台的迁移，并对平台迁移操作的关键点进行了详细分析，提出了在解析托管服务迁移过程中能够保证业务连续性的迁移机制。

关键词: DNS系统, DNS安全扩展系统, 密钥轮转, 域名解析, 信任链

Abstract:

Based on the migration and deployment practice of the top-level domain resolution service hosting platform, in order to avoid the occurrence of domain name system security extension (DNSSEC, DNS security ex-tension) trust chain and resolution service interruption, domain name NS record inconsistency and other security issues in the DNSSEC environment, research and analysis was focused on how to migrate the resolution service between the old and new service hosting platform and the internet assigned numbers authority (IANA) without breaking the integrity of the DNSSEC trust chain during the key rollover, DS and NS record changes, data update and other stages.To improve the availability of domain name system services, the key points of the platform migration operation were analyzed in detail, and the migration mechanism that can ensure business continuity during the migration process were proposed.

Key words: DNS system, DNS security extension system, key rollover, domain name resolution, trust chain

中图分类号:

TP393

何峥, 冷峰, 张翠玲. 在DNSSEC下保障顶级域名解析托管服务稳定迁移的操作机制[J]. 网络与信息安全学报, 2021, 7(3): 156-165.

Zheng HE, Feng LENG, Cuiling ZHANG. Operation mechanism for ensuring the stable migration of top-level domain name resolution hosting services with DNSSEC[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 156-165.

图/表 9

图1

图2

图3

表1

表2

表3

表4

表5

表6

参考文献 14

[1]	苑朋朋, 王常青 . DNS安全威胁及应对措施研究[J]. 网络空间安全, 2018,9(5): 50-54.
	YUAN P P , WANG C Q . Research on DNS security threats and countermeasures, 2018,9(5): 50-54.
[2]	KOLKMAN O , MEKKING W , GIEBEN R . RFC 6781:DNSSEC operational PRactices[S]. RFC IETF, 2012.
[3]	EASTLAKE D . RFC 2065:domain name system security extensions[S]. RFC IETF, 1997.
[4]	EASTLAKE D . RFC 2535:domain name system security extensions[S]. RFC IETF, 1999.
[5]	AUSTEIN R , LARSON M . RFC 4033:DNS security introduction and requirements[S]. RFC IETF, 2005.
[6]	ARENDS R , AUSTEIN R , LARSON M ,et al. RFC4034:resource records for the dns security extensions[S]. RFC IETF, 2005.
[7]	ARENDS R , AUSTEIN R , LARSON M ,et al. RFC4035:protocol modifications for the dns security extensions[S]. RFC IETF, 2005.
[8]	LAURIE B , SISSON G , ARENDS R ,et al. RFC 5155:DNS security(DNSSEC) hashed authenticated denial of existence[S]. RFC IETF, 2003.
[9]	Root DNSSEC update[EB].
[10]	TLD DNSSEC report[EB].
[11]	New gTLD program statistics[EB].
[12]	段海新 . DNSSEC原理、配置与部署[J]. 中国教育网络, 2011,(6): 29-31.
	DUAN H X . DNSSEC principle,configuration and deployment[J]. China Education Network, 2011,(6): 29-31.
[13]	段海新 . DNSSEC原理、配置与部署（二）[J]. 中国教育网络, 2011,(7): 34-35.
	DUAN H X . DNSSEC principle,configuration and deployment(2)[J]. China Education Network, 2011,(7): 34-35.
[14]	高二辉, 张跃冬, 何峥 . DNSSEC 技术原理及应用研究[J]. 信息安全与技术, 2013,(1): 10-15.
	GAO E H , ZHANG Y D , HE Z . The principle and application research of DNSSEC[J]. Information Security and Technology, 2013,(1): 10-15.

可能情况	DS	DNSKEY	RRSIG
1	DS-A	DNSKEY-A	RRSIG-A
2	DS-A	DNSKEY-A	RRSIG-A
	DS-B
3	DS-A	DNSKEY-A	RRSIG-A
		DNSKEY-B
4	DS-A	DNSKEY-A	RRSIG-A
	DS-B	DNSKEY-B	RRSIG-A

可能情况	DS	DNSKEY	RRSIG
1	DS-A	DNSKEY-A	RRSIG-A
	DS-B	DNSKEY-B
2	DS-A	DNSKEY-A	RRSIG-B
	DS-B	DNSKEY-B

可能情况	DS	DNSKEY	RRSIG
1	DS-A	DNSKEY-A	RRSIG-A
	DS-B	DNSKEY-B
2	DS-A	DNSKEY-A	RRSIG-A
		DNSKEY-B
3	DS-A	DNSKEY-A	RRSIG-B
	DS-B	DNSKEY-B
4	DS-A	DNSKEY-A	RRSIG-B
		DNSKEY-B

可能情况	DS	DNSKEY	RRSIG
1	DS-A	DNSKEY-A	RRSIG-B
	DS-B	DNSKEY-B

可能情况	DS	DNSKEY	RRSIG
1	DS-A	DNSKEY-A	RRSIG-B
	DS-B	DNSKEY-B
2	DS-B	DNSKEY-A	RRSIG-B
		DNSKEY-B
3	DS-A	DNSKEY-B	RRSIG-B
	DS-B
4	DS-B	DNSKEY-B	RRSIG-B

在DNSSEC下保障顶级域名解析托管服务稳定迁移的操作机制

Operation mechanism for ensuring the stable migration of top-level domain name resolution hosting services with DNSSEC

在线阅读

pdf下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 14

相关文章 1

Metrics

推荐阅读 0