Secure Online DNS Dynamic Updates: Architecture and Implementation

Domain Name System (DNS) is the Internet infrastructure for mapping human-friendly domain names into IP addresses. To provide data-origin authentication for DNS, the DNS Security Extension (DNSSEC) standard was developed. In this article, we point out two drawbacks of DNSSEC in its handling of DNS dynamic updates: 1) creating a single point of attack with the on-line storage of a zone security key, and 2) violating the role separation principle by mixing up the roles of zone security managers and DNS name server administrators. To address these issues, we propose an alternative secure DNS architecture based on threshold cryptography. To demonstrate the feasibility of the proposed architecture, we developed a toolkit and built a proof-of-concept prototype. Our running results show that the performance of our architecture ranges from one to four times of DNSSEC’s performance. Thus, through small performance overhead, our architecture could achieve very high level of security.