TY - GEN
T1 - On the performance and analysis of DNS security extensions
AU - Curtmola, Reza
AU - Del Sorbo, Aniello
AU - Ateniese, Giuseppe
PY - 2005
Y1 - 2005
N2 - The Domain Name System (DNS) is an essential component of the critical infrastructure of the Internet. The role of DNS is vital, as it is involved in virtually every Internet transaction. It is sometimes remarked that DNS works well as it is now and any changes to it may disrupt its functionality and add complexity. However, due to its importance, an insecure DNS is unacceptable for current and future networks. The astonishing simplicity of mounting an attack against the DNS and the damaging potential of such an attack should convince practitioners and system administrators to employ a secure version of DNS. However, security comes with a cost. In this paper, we examine the performance of two proposals for secure DNS and we discuss the advantages and disadvantages of both. In particular, we analyze the impact that security measures have on the performance of DNS. While it is clear that adding security will lower DNS performance, our results show that the impact of security can be mitigated by deploying different security extensions at different levels in the DNS tree. We also describe the first implementation of the SK-DNSSEC [1] protocol. The code is freely downloadable and released under an open-source license.
AB - The Domain Name System (DNS) is an essential component of the critical infrastructure of the Internet. The role of DNS is vital, as it is involved in virtually every Internet transaction. It is sometimes remarked that DNS works well as it is now and any changes to it may disrupt its functionality and add complexity. However, due to its importance, an insecure DNS is unacceptable for current and future networks. The astonishing simplicity of mounting an attack against the DNS and the damaging potential of such an attack should convince practitioners and system administrators to employ a secure version of DNS. However, security comes with a cost. In this paper, we examine the performance of two proposals for secure DNS and we discuss the advantages and disadvantages of both. In particular, we analyze the impact that security measures have on the performance of DNS. While it is clear that adding security will lower DNS performance, our results show that the impact of security can be mitigated by deploying different security extensions at different levels in the DNS tree. We also describe the first implementation of the SK-DNSSEC [1] protocol. The code is freely downloadable and released under an open-source license.
UR - http://www.scopus.com/inward/record.url?scp=33744825717&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=33744825717&partnerID=8YFLogxK
U2 - 10.1007/11599371_24
DO - 10.1007/11599371_24
M3 - Conference contribution
AN - SCOPUS:33744825717
SN - 3540308490
SN - 9783540308492
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 288
EP - 303
BT - Cryptology and Network Security - 4th International Conference, CANS 2005, Proceedings
T2 - 4th International Conference on Cryptology and Network Security, CANS 2005
Y2 - 14 December 2005 through 16 December 2005
ER -