Perils of Transitive Trust in the Domain Name System Chen Xi Chen Xi

Venugopalan Ramasubramanian &Emin Gun Sirer Dept. of Computer Science Cornell University

DNS namespace is hierarchically partitioned into non overlapping regions called domains.

Every name resolving process will follow a certain routine starting from the top of the DNS hierarchy then following the chain of delegation. Nameserver delegation based architecture complex inter-dependencies between names and nameservers

Delegation graph: the dependencies among nameservers that directly or indirectly affect a domain name. it consists of the transitive closure of all name servers involved in the resolution of a given name. TCB (trusted computing base ): the nameservers in the delegation graph of a domain name value of a nameserver: is proportional to the number of domain names which depend on that nameserver. (high-leverage nameservers)

Risks of Transitive Trust Unexpected nodes to exert great control over remote domains Client can be attacked if any of these namesevers is compromised.

3 problems proposed by author DNS is highly insecure due to the obscure dependencies between names and nameservers difficult to make a balance between the availability and security existing high-leverage nameservers have little awareness of the security risks.

Surveys amon TLD from 3 aspects the most vulnerable names Impact of Known Exploits Most Valuable Nameservers

Results 15% of the 500 most popular websites depend on more than 200 nameservers. 45% names under perils (poisoning ) 2.5 compromised servers can attack the complete domain on average (a DoS on the non-vulnerable nameserver, coupled with the compromise of the other vulnerable bottleneck nameservers) high-leverage nameservers have little motivation to take on NNS task.

Stopgap measure DNS was not originally designed with security in mind. achieve name security on the Internet Network administrators should be aware of the vulnerabilities in DNS more diligent about where they place their trust

One existing solution DNSSEC modifies DNS to add support for cryptographically signed responses. But DNSSEC continues to rely on the same physical delegation chains as DNS during lookups. attackers can exploit vulnerabilities outlined in this paper to launch DoS attacks on Web services and disrupt name resolutionDNSSEC

My idea on the problem When rely on other domain servers to resolve a name, we can introduce the Jun hai Luo ’ s trust recommendation between domains. Servers with high trust recommendation in remote domains can be used to resolve the name.

Architecture (cited) ij2j2 jKjK j1j1 … K R i R jk,m R j R i,m m