在DNSSEC下保障顶级域名解析托管服务稳定迁移的操作机制  

Operation mechanism for ensuring the stable migration of top-level domain name resolution hosting services with DNSSEC

作　　者：何峥[1] 冷峰[1] 张翠玲[1] HE Zheng;LENG Feng;ZHANG Cuiling(China Internet Network Information Center,Beijing 100190,China)

机构地区：[1]中国互联网络信息中心,北京100190

出　　处：《网络与信息安全学报》2021年第3期156-165,共10页Chinese Journal of Network and Information Security

基　　金：北京市科技新星计划项目(Z191100001119113)。

摘　　要：基于顶级域解析服务托管平台迁移部署实践,重点研究分析了在DNSSEC环境下,为避免发生域名系统安全扩展(DNSSEC,DNS security extension)信任链及解析服务中断、域名NS记录不一致等安全问题,如何在密钥轮转、DS和NS记录变更、数据更新等环节中实现新旧服务托管商及互联网数字分配机构(IANA,internet assigned numbers authority)之间进行解析服务平台的迁移,并对平台迁移操作的关键点进行了详细分析,提出了在解析托管服务迁移过程中能够保证业务连续性的迁移机制。Based on the migration and deployment practice of the top-level domain resolution service hosting plat-form,in order to avoid the occurrence of domain name system security extension(DNSSEC,DNS security ex-tension)trust chain and resolution service interruption,domain name NS record inconsistency and other security issues in the DNSSEC environment,research and analysis was focused on how to migrate the resolution service be-tween the old and new service hosting platform and the internet assigned numbers authority(IANA)without break-ing the integrity of the DNSSEC trust chain during the key rollover,DS and NS record changes,data update and other stages.To improve the availability of domain name system services,the key points of the platform migration operation were analyzed in detail,and the migration mechanism that can ensure business continuity during the mi-gration process were proposed.

关 键 词：DNS系统 DNS安全扩展系统 密钥轮转 域名解析 信任链 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]