DHT expanded DNS mapping system and method for realizing DNS security

Abstract

The invention discloses a distributed hash table (DHT) expanded domain name system (DNS) mapping system and a method for realizing DNS security. The mapping system comprises a host with a DNS resolver, a local and authorized DNS server and a DHT server in a DHT ring, wherein the DNS server and the DHT server serving as mapping servers manage mapping information from identity to position together and query mapping information for the host. The system synthesizes the advantages of the DNS and the DHT, absorbs a DNS tree structure, supports hierarchical query of the mapping information, is provided with reasonable commercial and trust models, and succeeds the advantages of DHT redundancy backup, strong robustness and the like; and the system can be realized on the basis of the conventional DNS mapping system so as to reduce a large amount of financial resource and manpower of network construction. A complete trust chain is established between the DHT ring and the upper DNS server, a transaction signature (TSIG) key is automatically distributed by using an ID management server positioned in an identity and position separation architecture, and the original DNS signature (DNSSEC) and TSIG security mechanisms of the DNS are ensured to be completely realized in the DHT expanded DNS mapping system.

Description

technical field [0001] The invention relates to a DHT-extended DNS mapping system and a method for realizing DNS security, belonging to the technical field of network communication. Background technique [0002] The network architecture based on the separation of the identity ID and the location Locator on the host side, such as the host identification protocol HIP (Host Identity Protocol) and the next generation Internet routing architecture RANGI (Routing Architecture for the Next Generation Internet) is based on the existing TCP / IP protocol stack network The host identification ID layer is introduced between the transport layer and the transport layer, so that the transport layer session is only bound to the host ID layer, thus solving the dual semantic problem of IP addresses in the existing Internet. Each host or terminal in the network has its own identity, that is, the host ID. The host ID must be globally unique, topology-independent, and portable. Locator is the lo...

AI Technical Summary

Problems solved by technology

[0022] In the original DNS mapping system, DNSSEC has a relatively perfect method of protecting the integrity and security of mapping information. However, after using the DHT ring to expand the DNS mapping system, DNSSEC cannot be realized: first, the trust chain of hierarchical authorization cannot be established by combining DNS with DHT In the mapping system, the signature of the mapping information should be implemented in the DHT ring that manages the mapping data

Images