Search

Based on the migration and deployment practice of the top-level domain resolution service hosting platform, in order to avoid the occurrence of domain name system security extension (DNSSEC, DNS security ex-tension) trust chain and resolution service interruption, domain name NS record inconsistency and other security issues in the DNSSEC environment, research and analysis was focused on how to migrate the resolution service between the old and new service hosting platform and the internet assigned numbers authority (IANA) without breaking the integrity of the DNSSEC trust chain during the key rollover, DS and NS record changes, data update and other stages.To improve the availability of domain name system services, the key points of the platform migration operation were analyzed in detail, and the migration mechanism that can ensure business continuity during the migration process were proposed.

Based on the migration and deployment practice of the top-level domain resolution service hosting platform, in order to avoid the occurrence of domain name system security extension (DNSSEC, DNS security ex-tension) trust chain and resolution service interruption, domain name NS record inconsistency and other security issues in the DNSSEC environment, research and analysis was focused on how to migrate the resolution service between the old and new service hosting platform and the internet assigned numbers authority (IANA) without breaking the integrity of the DNSSEC trust chain during the key rollover, DS and NS record changes, data update and other stages. To improve the availability of domain name system services, the key points of the platform migration operation were analyzed in detail, and the migration mechanism that can ensure business continuity during the migration process were proposed.

The domain name system (DNS) is the naming system on the Internet. With the DNS security extensions (DNSSECs) operators can protect the authenticity of their domain using public key cryptography. DNSSEC, however, can be difficult to configure and maintain: operators need to replace keys to upgrade their algorithm, react to security breaches or follow key management policies. These tasks are not trivial. If operators do not time changes to their keys right, caching resolvers may not have access to the correct keys, potentially rendering DNS zones unavailable for minutes or hours. While best current practices give abstract guidelines on how to introduce and withdraw keys, information on how to monitor and control actual rollovers in a live environment is lacking. More specifically, it is challenging for operators to know when to introduce or withdraw keys based on the state of the network. Our main contribution is to help operators answer this question and to address this barrier for deploying DNSSEC. We develop a method with which operators can monitor the replacement of DNSSEC keys, called a rollover. Thereby, they can make confident decisions during the rollover and make sure their zone stays available at all times. We validate the method with an algorithm rollover of the Swedish TLD.se and provide an open source tool with which operators can monitor their rollover themselves. [ABSTRACT FROM AUTHOR]

The article introduces an ambient intelligence system for blind people which besides providing assistance in home environment also helps with various situations and roles in which blind people may find themselves involved. RUDO, the designed system, comprises several modules that mainly support or ensure recognition of approaching people, alerting to other household members' movement in the flat, work on a computer, supervision of (sighted) children, cooperation of a sighted and a blind person (e.g., when studying), control of heating and zonal regulation by a blind person. It has a unified user interface that gives the blind person access to individual functions. The interface for blind people offers assistance with work on a computer, including writing in Braille on a regular keyboard and specialized work in informatics and electronics (e.g., programming). RUDO can complement the standard aids used by blind people at home, it increases their independence and creates conditions that allow them to become fully involved. RUDO also supports blind people sharing a home with sighted people, which contributes to their feeling of security and greater inclusion in society. RUDO has been implemented in a household for two years, which allows an evaluation of its use in practice. [ABSTRACT FROM AUTHOR]

The article introduces an ambient intelligence system for blind people which besides providing assistance in home environment also helps with various situations and roles in which blind people may find themselves involved. RUDO, the designed system, comprises several modules that mainly support or ensure recognition of approaching people, alerting to other household members’ movement in the flat, work on a computer, supervision of (sighted) children, cooperation of a sighted and a blind person (e.g., when studying), control of heating and zonal regulation by a blind person. It has a unified user interface that gives the blind person access to individual functions. The interface for blind people offers assistance with work on a computer, including writing in Braille on a regular keyboard and specialized work in informatics and electronics (e.g., programming). RUDO can complement the standard aids used by blind people at home, it increases their independence and creates conditions that allow them to become fully involved. RUDO also supports blind people sharing a home with sighted people, which contributes to their feeling of security and greater inclusion in society. RUDO has been implemented in a household for two years, which allows an evaluation of its use in practice.

The Domain Name System (DNS) is a distributed tree-based database largely used to translate a human readable machine name into an IP address. The DNS security extensions (DNSSEC) has been designed to protect the DNS protocol using public key cryptography and digital signatures. Every secure DNS zone owns at least a key pair (public/private) to provide two security services: data integrity and authentication. To trust some DNS data, a DNS client has to verify the signature of this data with the right zone key. This verification is based on the establishment of a chain of trust. To build this chain of trust, a DNSSEC client needs a secure entry point: a zone key configured as trusted in the client. In this paper, we study the management problem of this kind of key also call the trusted key rollover problem. We propose a new resource record (RR) to automate this rollover and avoid the inconsistency problem between the resolver key set and the name server key set. Without our new record and solution, this problem needs an administrator action to be solved. [ABSTRACT FROM AUTHOR]

The DNS Security Extensions (DNSSEC) are among the first attempts to deploy cryptographic protections in an Internet-scale operational system. DNSSEC applies well-established public key cryptography to ensure data integrity and origin authenticity in the DNS system. While the cryptographic design of DNSSEC is sound and seemingly simple, its development has taken the IETF over a decade and several protocol revisions, and even today its deployment is still in the early stage of rolling out. In this paper, we provide the first systematic examination of the design, deployment, and operational challenges encountered by DNSSEC over the years. Our study reveals a fundamental gap between cryptographic designs and operational Internet systems. To be deployed in the global Internet, a cryptographic protocol must possess several critical properties including scalability, flexibility, incremental deployability, and ability to function in face of imperfect operations. We believe that the insights gained from this study can offer valuable inputs to future cryptographic designs for other Internet-scale systems. [ABSTRACT FROM PUBLISHER]