Rolling With Confidence: Managing the Complexity of DNSSEC Operations

Abstract

The domain name system (DNS) is the naming system on the Internet. With the DNS security extensions (DNSSECs) operators can protect the authenticity of their domain using public key cryptography. DNSSEC, however, can be difficult to configure and maintain: operators need to replace keys to upgrade their algorithm, react to security breaches or follow key management policies. These tasks are not trivial. If operators do not time changes to their keys right, caching resolvers may not have access to the correct keys, potentially rendering DNS zones unavailable for minutes or hours. While best current practices give abstract guidelines on how to introduce and withdraw keys, information on how to monitor and control actual rollovers in a live environment is lacking. More specifically, it is challenging for operators to know when to introduce or withdraw keys based on the state of the network. Our main contribution is to help operators answer this question and to address this barrier for deploying DNSSEC. We develop a method with which operators can monitor the replacement of DNSSEC keys, called a rollover. Thereby, they can make confident decisions during the rollover and make sure their zone stays available at all times. We validate the method with an algorithm rollover of the Swedish TLD .se and provide an open source tool with which operators can monitor their rollover themselves.

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

“…Osterweil et al [38] Deccio et al [12] ' 13 Lian et al [28] ' 15 Chung et al [10] Müller et al [32] van Rijswijk-Deij et al [43] Müller et al [33] Data coverage DNS(SEC) Events In this work, we propose to represent the complexity of key transitions by identifying which elements are necessary to measure (which we define as the anatomy of DNSSEC key transitions), and a measurement methodology to quantify key transitions seen in the wild. By using our anatomy and transition model as a platform, we are able to model key transition behaviors in the wild from both RFCs [31,41] and from related work in the literature [44].…”

2019 Index IEEE Transactions on Network and Service Management Vol. 16

“…1537Dec. -1551 Inoue, T., see Carrera, D., T- NSM Sept. 2019 797-799 Iqbal, W., see Baig, S., T-NSM Dec. 20191681-1693 Min, G., see Wang, X., T-NSM Sept. 20191226-1239MirHassani, S.A., see Farkiani, B., T-NSM Dec. 20191360-1373 Mislove, A., see Muller, M., T-NSM Sept. 20191199-1211 Mohaisen, A., see 1782-1796 Mohan, P.M., see Truong-Huu, T., T-NSM Dec. 1724Dec.…”

“…Uhlig, S., see Ding, J., T-NSM June 2019 743-754 Ul Huque, M.T.I., Jourjon, G.,Russell, C., and Gramoli, V., Software Defined Network's Garbage Collection With Clean-Up Packets; T-NSM Dec. see Sunny, A., T-NSM Dec. 2019 1812-1825 Through Machine Learning; T-NSM Sept. 2019 896-908 van Rijswijk-Deij, R., seeMuller, M., T-NSM Sept. 2019 1199-1211 file-Based Resource Allocation for Virtualized Network Functions; T-NSM 1374-1388 Varasteh, A., see He, M., T-NSM Dec. 2019 1694-1708 Varvarigos, E.A., seeKokkinos, P., T-NSM June 2019 489-504 Venkitesh, B., and Rosenberg, C., Smart Roaming: How Operator Cooperation Can Increase Spectrum Usage Efficiency at Practically No Cost; T-NSM June 2019 690-700 Vishwarupe, S., seeLatif, A., T-NSM Dec. 2019 1855-1868 Vitale, C., see Avino, G., T-NSM Dec. 2019 1450-1463 W Wang, C., see Syu, Y., T-NSM March 2019 56-71 Wang, D., see Chen, I., T-NSM March 2019 246-263 Wang, D., see Li, Q., T-NSM March 2019 153-166 Wang, G., Feng, G., Quek, T.Q.S., Qin, S., Wen, R., and Tan, W., Reconfiguration in Network Slicing-Optimizing the Profit and Performance; T-NSM June 2019 591-605 Wang, H., see Wang, X., T-NSM Dec. 2019 1768-1781 Wang, J., see Zhang, X., T-NSM March 2019 294-307 Wang, J., see Xu, C., T-NSM June 2019 563-577 Wang, J., Qi, H., He, Y., Li, W., Li, K., and Zhou, X., FlowTracer: An Effective Flow Trajectory Detection Solution Based on Probabilistic Packet Tagging in SDN-Enabled Networks; T-NSM Dec. 2019 1884-1898 Wang, J., see Carrera, D., T-NSM Sept. 2019 797-799 Wang, L., see Abdullaziz, O.I., T-NSM June 2019 618-631 Wang, L., see Wang, X., T-NSM Sept. 2019 1226-1239 Wang, X., Wang, H., Ding, J., Li, Y., and Jin, D., Location Semantics Identification via Users' Clickstreams in Mobile Social Networking; T-NSM Dec. 2019 1768-1781 Wang, X., see Zhao, B., T-NSM Dec. 2019 1581-1594 Wang, X., Hao, F., Min, G., and Wang, L., Efficient Coupling Diffusion of Positive and Negative Information in Online Social Networks; T-NSM Sept. 2019 1226-1239 Wang, X., see Wang, X., T-NSM Sept. 2019 1226-1239 Wang, Y., see Habibi Gharakheili, H., T-NSM Sept. 2019 1071-1085 Wang, Y., see Zhao, N., T-NSM Sept. 2019 1170-1183 Wang, Z., Zhang, J., Huang, T., and Liu, Y., Service Function Chain Composition, Placement, and Assignment in Data Centers; T-NSM Dec. 2019 1638-1650 Wehner, N., see Seufert, M., T-NSM June 2019 475-488 Wei, W., see Hsieh, C., T-NSM March 2019 348-361 Welzl, M., see Bianchi, G., T-NSM Dec. 2019 1507-1521 Wen, R., see Wang, G., T-NSM June 2019 591-605 Wen, W., see Dong, C., T-NSM June 2019 729-742 Weng, H., see Nguyen, N., T-NSM March 2019 192-205 Weng, N., see Hsieh, C., T-NSM March 2019 348-361 Wion, A., Bouet, M., Iannone, L., and Conan, V., Change in Continuity: Chaining Services With an Augmented IGP; T-NSM Dec. 2019 1332-1344 Wolf, T., see Zhao, B., T-NSM Dec. 2019 1581-1594 Wu, C., see Tseng, Y., T-NSM March 2019 143-152 Wu, Q., see Zhang, J., T-NSM March 2019 321-333 X Xiao, S., see Ding, J., T-NSM June 2019 743-754 Xiao, W., Zhu, X., Bao, W., Liu, L., and Yao, J., Cooperative Data Sharing for Mobile Cloudlets Under Heterogeneous Environments; T-NSM June 2019 430-444 Xie, G., see Zhang, J., T-NSM March 2019 321-333 Xing, J., see Zhang, X., T-NSM March 2019 294-307 Xu, C., Wang, J., Zhu, Z., and Niyato, D., Energy-Efficient WLANs With Resource and Re-Association Scheduling Optimization; T-NSM June 2019 563-577 Xu, F., see Tu, Z., T-NSM March 2019 264-278 Xu, F., see Zhao, K., T-NSM Sept. 2019 1212-1225 Xu, T., see Dong, C., T-NSM June 2019 729-742 Xue, K., see Li, D., T-NSM Dec. 2019 1651-1664 Y Yahia, I.G.B., see Cherrared, S., T-NSM Dec. 2019 1537-1551 Yamanaka, H., Kawai, E., Teranishi, Y., and Harai, H., Proximity-Aware IaaS in an Edge Computing Environment With User Dynamics; T-NSM Sept. 2019 1282-1296 Yang, H., see An, J., T-NSM Sept. 2019 1255-1267 Yang, L., and Yang, N., An Integrated Event Summarization Approach for Compl...…”

Making DNSSEC Future Proof

“…After .se, .br (Brazil) and .dk (Denmark) applied our monitoring method as well. We published the study on which this chapter is based in a scienti c journal [19] and a tool, allowing operators to monitor their own rollover, as open source [162]. Additionally, we presented our work to a broader operator community at a RIPE meeting [163].…”

“…This algorithm rollover needs to be carried out carefully. If not, resolvers could fail to validate the signatures and could consider the RR bogus [16], [19].…”