The design and implementation of a next generation name service for the internet

Abstract

Name services are critical for mapping logical resource names to physical resources in large-scale distributed systems. The Domain Name System (DNS) used on the Internet, however, is slow, vulnerable to denial of service attacks, and does not support fast updates. These problems stem fundamentally from the structure of the legacy DNS.This paper describes the design and implementation of the Cooperative Domain Name System (CoDoNS), a novel name service, which provides high lookup performance through proactive caching, resilience to denial of service attacks through automatic load-balancing, and fast propagation of updates. CoDoNS derives its scalability, decentralization, self-organization, and failure resilience from peer-to-peer overlays, while it achieves high performance using the Beehive replication framework. Cryptographic delegation, instead of host-based physical delegation, limits potential malfeasance by namespace operators and creates a competitive market for namespace management. Backwards compatibility with existing protocols and wire formats enables CoDoNS to serve as a backup for legacy DNS, as well as a complete replacement. Performance measurements from a real-life deployment of the system in PlanetLab shows that CoDoNS provides fast lookups, automatically reconfigures around faults without manual involvement and thwarts distributed denial of service attacks by promptly redistributing load across nodes.

Popularity-aware prefetch in P2P range caching

“…The number of range queries within each epoch 11 follows Poisson distribution with mean m = 100; the query execution process runs for 20 epochs. To simulate the Power-law characteristics of query load that is common in real world [16], the range domain is evenly partitioned into a configurable number (i.e., 10) of range segments; the start point (i.e., lower bound) of each range query is generated over a randomly chosen segment based on the principles of growth and preferential attachment, which produce Power-law query distribution [2]. When a query is issued more than a number of times and becomes "popular", peers issuing it start to migrate the query.…”

Enhancing DNS Resilience against Denial of Service Attacks

“…Previous efforts [10,21,20,12,11] of enhancing the DNS resilience against DDos attacks focus on reducing or eliminating critical points of failure in the DNS hierarchy. Either they introduce new ways of resolving the nameservers [21,12] which do not coincide with the name-space tree structure, or they abandon completely the concept of name-servers [10,20,11], at least in the way that they are currently defined.…”

“…Either they introduce new ways of resolving the nameservers [21,12] which do not coincide with the name-space tree structure, or they abandon completely the concept of name-servers [10,20,11], at least in the way that they are currently defined. As a consequence these previous proposals require substantial changes in the DNS infrastructure.…”

“…Smaller zones may not be able to afford adding a large number of name-servers. Other solutions proposed by the research community [10,21,20,12,11] address the problem of DDoS attacks against DNS by introducing major protocol changes or by redesigning the whole system. Although some of them are considered incrementally deployable, their adoption is hindered by the operators' reluctance to introducing major changes in an operational system.…”

Resilient and efficient load balancing in distributed hash tables

“…DHT is now emerging as a promising approach to build efficient infrastructures for large-scale distributed applications, such as grid information services (Cai et al, 2003), Peer-to-Peer file-sharing systems (Emule project, 2006), domain naming services (Ramasubramanian and Sirer, 2004), storage systems (Kubiatowicz et al, 2000), content distribution networks (Coral Content Distribution Network, 2006), etc.…”