Abstract
Domain Name System(DNS) is an inevitable component of the critical infrastructure of the Internet.
It is a hierarchical distributed database system which provides a crucial service for the internet i.e. the
mapping of human-friendly domain names to their respective machine-friendly IP addresses and vice
versa. Almost all internet-based applications including http, ftp and email, need to resolve a given
domain name to its respective IP address prior to establishing connections. DNS provides the mapping
service which is fundamental not only to the health of the Internet but also to the protection and integrity
of the data. In case, mapping of a domain name to an IP address in the system gets corrupted, the
system would no longer be acceptable. Being probably the most valuable infrastructure in the Internet,
its security is of utmost priority.
The domain names in a DNS database are stored in the form a hierarchical tree structure which is
known as domain name space. Each node in the tree contains zero or more resource records which
hold information associated with a domain name. DNS cache these resource records for a specific time
period, i.e., TTL (Time-To-Live). TTL too plays an important role in maintaining the consistency of
the cached resource records. Short TTL reduces the likelihood of getting old information but increases
the DNS utilization whereas long TTL decreases the DNS utilization but at the same time increases the
chance of retrieving outdated information.
DNS was not earlier designed to save itself against different kinds of attacks such as cache poisoning,
rebinding attacks etc. This is the reason that DNS servers have been manipulated by attackers to launch
phishing attacks, to commit click-frauds and to drive traffic to malicious websites. Among all the
different kinds of attacks on DNS, DNS cache poisoning is the prominent one. DNS cache poisoning
refers to the cases where the cache of a DNS server gets corrupted due to the injection of false mapping
in the server which affects the accuracy of DNS lookups. Consequently, when queries arrive at the DNS
server, inaccurate and probably malicious replies are sent as the response. False mapping can be injected
into a DNS in many ways i.e. by dns spoofing, dns forgery etc. After one poisoned record is injected
into the cache, it can spread to other parts of the cache or other servers through query/response between
servers. DNS cache poisoning could be used by an attacker to redirect the querier to a non-existent IP
address, thus causing Denial-of Service or the querier can be redirected to a malicious website which
drops Malware/Spyware or s/he could even be redirected to attacker’s website, causing phishing attack.
Till date, many different solutions have been proposed to overcome the problem of cache poisoning but
none has been deployed successfully. Certain proposed solutions like DNSSEC, DNSCurve etc, found to be efficient against cache poisoning but they have not been successfully deployed primarily because
of the complexity involved in key management. Certain other solutions were neglected because either
they required changes in the DNS protocol or they introduced considerable latency in the system making
them an undesirable solution. Hence, in spite of all the solutions proposed till date to mitigate cache
poisoning attacks, the problem still persists.
To mitigate cache poisoning attacks, we have proposed an approach - Domain ConsistencyManagement
system (DCMS) which makes the use of response delays for a specific resource-record type between a
DNS client and a DNS server. Our approach is similar to stimulus-response model in which a response
is expected for a specific stimulus within a specific period of time. If the response is received out of the
period then it could be the result of some flaw in the system. Similarly in our approach we expect the
response of a DNS query for a specific resource-record type to be received within a certain period of
time. In case the DNS response is received out of period we suspect an attack on the system and perform
a check to ensure the consistency of the response received. The significant feature of our approach lies
in its self-learning that in parallel it updates its database of response delays for a specific resource-
record type between specific DNS client and DNS server, thereby helping the system not only in proper
functioning, even it enhances its performance.
DCMS makes cache poisoning attacks, almost infeasible, even for motivated and powerful attackers.
The biggest advantage of our approach is that it does not require any change in the DNS protocol, hence
it could be deployed on a large scale within a short period of time. It does not even require any changes
at the server side as inWSEC-DNS to ensure the consistency of the responses. Since it does not involve
any cryptography technique, hence any sort of key management is not re