基于PKI的DNS安全防护研究  

Research on PKI-based DNS Security Protection

作　　者：章强[1] 彭飞[1] ZHANG Qiang;PENG Fei(Yangzhou Polytechnic College,Yangzhou 225009,China)

机构地区：[1]扬州职业大学,江苏扬州225009

出　　处：《扬州职业大学学报》2023年第2期58-62,共5页Journal of Yangzhou Polytechnic College

基　　金：江苏省现代教育技术课题(2021-R-96762);扬州职业大学高等教育科学研究课题(2023GJ12)。

摘　　要：DNSSEC协议逐层数字签名的分层结构牵涉到复杂的多次手工滚动交换密钥,造成其在互联网上的实际部署率很低。基于PKI的DNS安全防护方案,开发了一个验证程序,基于私有云搭建测试环境进行仿真测试,针对DNS记录的数据响应延迟和存储消耗两个指标与DNSSEC方案进行比较,结果表明,采用CA证书的DNS防护方案能有效减少各层权威DNS服务器的存储开销并降低DNS解析响应延迟。The hierarchical digital signature structure of DNSSEC protocol involves complex multiple manual rolling key exchange,resulting in its low actual deployment rate on the Internet.A verification program is developed for the DNS security protection scheme based on PKI,and simulation tests are carried out based on the test environment set up by private cloud.The DNS records are compared with the DNSSEC scheme in terms of data response delay and storage consumption.Test results show that the DNS protection scheme using CA certificate can effectively reduce the storage overhead and lower the response delay of DNS resolution at all layers of authoritative DNS servers,and initially realize a lightweight solution for DNS protection.

关 键 词：DNS DNSSEC PKI 数字证书 安全防护 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]