Research Article
An On-Demand Defense Scheme Against DNS Cache Poisoning Attacks
@INPROCEEDINGS{10.1007/978-3-319-78813-5_43, author={Zheng Wang and Shui Yu and Scott Rose}, title={An On-Demand Defense Scheme Against DNS Cache Poisoning Attacks}, proceedings={Security and Privacy in Communication Networks. 13th International Conference, SecureComm 2017, Niagara Falls, ON, Canada, October 22--25, 2017, Proceedings}, proceedings_a={SECURECOMM}, year={2018}, month={4}, keywords={DNS Security Extensions DNS cache poisoning Model checking Query load Success rate}, doi={10.1007/978-3-319-78813-5_43} }- Zheng Wang
Shui Yu
Scott Rose
Year: 2018
An On-Demand Defense Scheme Against DNS Cache Poisoning Attacks
SECURECOMM
Springer
DOI: 10.1007/978-3-319-78813-5_43
Abstract
The threats of caching poisoning attacks largely stimulate the deployment of DNSSEC. Being a strong but demanding cryptographical defense, DNSSEC has its universal adoption predicted to go through a lengthy transition. Thus the DNSSEC practitioners call for a secure yet lightweight solution to speed up DNSSEC deployment while offering an acceptable DNSSEC-like defense. This paper proposes a new On-Demand Defense (ODD) scheme against cache poisoning attacks, still using but lightly using DNSSEC. In the solution, DNS operates in DNSSEC-oblivious mode unless a potential attack is detected and triggers a switch to DNSSEC-aware mode. The modeling checking results demonstrate that only a small DNSSEC query load is needed by the ODD scheme to ensure a small enough cache poisoning success rate.