Young-Sun LA NIDA/KRNIC

Transcription

1 Young-Sun LA NIDA/KRNIC

2 Introduction KR DNS Distributional map QPS(2008.3~2009.3) Query National TOP15 Cache statistics Conficker Domain Query DNSSEC Adopting status DNSSEC Architecture in.kr Plan DNSSEC Roadmap 2

3 NIDA/KRNIC p.kr Registry KR Domain exceeded a Million on 13 th Dec Registrars for KR Domains p.kr DNS Deployment 11 sites at home and abroad Cf.) 3 root mirror(f/nida, j/kt, m/kinx) p Organization Integration NIDA(KRNIC) is going to be KISA(KRNIC) in July. * KISA : Korea Internet & Security Agency 3

4 G3.DNS.KR (Mirror, DENIC) E1.DNS.KR (Mirror, CNNIC) D.DNS.KR(ISC) B.DNS.KR G.DNS.KR F.DNS.KR D1.DNS.KR (APR. 2008) C. DNS.KR E.DNS.KR G1.DNS.KR (Mirror, Verisign) (JUN. 2009) E2.DNS.KR (Mirror, BRNIC) (OCT. 2008) : IPv4 DNS : IPv4/IPv6 DNS 4

5 p APR : (new) D1 up, D down, Anycast, Load Balance p SEP : (new) E2 up, E&E1 down, Anycast, Load Balance p DEC : Total Traffic 20% drop, PTR(particularly abroad ) 5

6 Rank. Nation Contineltal Query(per Day) 1 Korea Asia 279,847,990 KR DNS( B ~G ) 2 U.S.A North America 188,444,149 KR DNS( G, D Mirror) 3 Russia Europe 41,014,349 4 German Europe 33,879,033 KR DNS( G Mirror) 5 China Asia 28,628,569 KR DNS( E Mirror) 6 England Europe 24,352,011 7 Japan Asia 23,308,707 8 France Europe 17,900,393 9 Canada North America 15,147, Italy Europe 11,607, Spain Europe 10,995, Nederland Europe 9,722, Taiwan Asia 8,408, Australia Pacific 7,725, Brazil South America 6,677,017 KR DNS( E Mirror) 6

7 Europe -Cache DNS : 121,110 -Source IPs : 469,378 Asia -Cache DNS : 81,557 -Source IPs : 340,892 North America - Cache DNS : 88,206 - Source IPs : 269,466 g-3.dns.kr, e-1.dns.kr, d.dns.kr, g-1.dns.kr, Kr DNS d-1.dns.kr, g.dns.kr, b.dns.kr, Cache DNS f.dns.kr, c.dns.kr, e-2.dns.kr, e.dns.kr, Africa -Cache DNS : 3,034 -Source IPs : 26,608 Korea Cache DNS : 11,748 Source IPs : 51,815 South America -Cache DNS : 23,530 - Source IPs : 158,2907

8 IP Gathering Period : 30/03/2009 ~ 31/03/2009 Total Source IP : 1,269,778 Cache checking : 1,094,635(86.2% done) p Cache/non-Cache : 318,213(29%)/776,596(71%) p Cf.) Total number of source IP in April : 10,830,000 8

9 KR Domain names affected by Conficker : about 40,000 domains(438 registered domains) (* provided by ICANN) Monitoring results p Queries to Conficker(suspected) KR domains 3/30 : 13,054 queries 3/31 : 81,830 4/1 : 3,718,426 4/2 : 5,125,077 p National TOP10 3/31 : KR-US-VN-FR-RU-CN-DE-CA-JP-TW 4/1 : CN-RU-VN-KR-IN-ID-UA-TH-PH-TW 4/2 : CN-RU-VN-KR-US-UA-IN-ID-TH-PH Queries 9

10 p UTF-8 -> Puny code p Traffic Increased p Need to get rid of wild card in the zone setting 10

11 p Normal : IN >= OUT p Abnormal : IN < OUT ( ) p Malformed packet detected 11

12 09:15: IP 169.***.**.** > domain: update+% [b2&3=0x2d36] [12288q] Type0 (Class 0)?. Type0 (Class 0)?. Type0 (Class 0)?. Type0 (Class 0)?. Type0 (Class 0)?. Type0 (Class 0)?. Type0 (Class 0)?. Type0 (Class 0)?.[ domain] ( ) packet sampling, a number of Malformed packet(above) were detected Source IP : 169.***.**.**(a university in U.S.A own the IP) Destination IP : (B.DNS.KR s IP) It s returned to normal after days 12

13 Trial system(nsec) with safedns.kr in 2007 Key administration research in 2008 Basic Policy Established : BIND P1 Patch : DLV(safedns.kr) setting : Roadmap Establishment : Trial system alteration to support NSEC3 : now 13

14 ROOT (.) < KRNIC KR Master DNS> < KR Slave DNS> Domain Registration System B.DNS.KR < Recursive DNS> DB C.DNS.KR Kr. < User> Zone Zone Generator Master DNS G.DNS.KR < DNSSEC Trial System> Key Generator Zone Signer DB Zone Generator Signed Zone SafeDNS.kr < ISC DLV Registry > : 3 rd party validation 14

15 15

16 Step by step p Safedns.kr -> go.kr -> kr Trial system improvement p NSEC->NSEC3 p cf.) DLV with NSEC3 Publicity campaign p Education Management S/W Development Versional Roadmap 16

17 2009 년 년 2011년 Key and Signing Policy Decision KEY Generator(HSM) Adopting Key KSK tool development(.kr) Key Repository Implementation Safedns.kr T.A. distributions Key/Signing Control Program Implementation Go.kr T.A. distribution First Key Generating for KR Zone (signi ng) cache serve r(vali datio n) DLV Adoption Zone extraction Programming Safedns.kr NSEC3 signing, BIND patch Auto-Resigning Program Activation Trust Anchor Auto Update Implementation Go.kr signing testbed Go.kr Signing Dynamic Update Implementation/validation, stress test Slave name server(isp) DNSSEC Recursive Implement collaboration.kr signing(all zones) Cache server extension.kr zone Trusted Key Registration Go.kr Zone Trusted Key Registration Admi n (web) User (etc.) Trial system web modification/upgread Key/Signing Admin web Development Trusted Anchor Distribution web Development S/W Tool, Client Application Test( ZKT, firefox, thunderbird, IE etc.) Public relations, H/W Infra extension Registrar web improement EPP, DB alteration.kr zone Trusted Key distribution on web Go.kr zone Trusted Key distribution on web : start : completion : opening 17

18 Root(.) Signing.KR Zone Signing (Month) Key and Signing Policy Decision KEY First Key Generating for KR Key Repository Implementation KEY Generator(HSM) Adopting Key/Signing Control Program Implementation ZONE (Signing) Cache (validation).kr Zone extraction-signingtransfer, operation test Auto-Resigning Program Activation Validation method alteration (DLV->Root Key) Cache server extension.kr Zone Signing, DS setting with Root Admin (web) Etc. PR, News Slave name server(isp) DNSSEC Recursive Implement collaboration Registrar web, EPP Program, DB alteration H/W Infra improvement : start : completion : opening 18

19 19