Dynamic DNS update security, based on cryptographically generated addresses and ID-based cryptography, in an IPv6 autoconfiguration context

Jean-Michel Combes (1, 2, 3, 4) , Ghada Arfaoui (1) , Maryline Laurent (1, 2, 4)

1 TSP - RST - Département Réseaux et Services de Télécommunications
2 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
3 Orange Labs [Issy les Moulineaux]
4 CNRS - Centre National de la Recherche Scientifique

This paper proposes a new security method for protecting signalling for Domain Name System (DNS) architecture. That is, it makes secure DNS update messages for binding a Fully Qualified Domain Name (FQDN) of an IPv6 node and the IPv6 address of the node owning this FQDN. This method is based on the use of Cryptographically Generated Addresses (CGA) and IDBased Cryptography (IBC). Combination of these two techniques allows DNS server to check the ownership of the IPv6 address and the FQDN, sent by the DNS client. In addition, this paper describes how this method has been implemented.

Mots clés: IPv6; DNS update; Security; ID-based cryptography; Cryptographically generated addresses

Domaines: Cryptographie et sécurité [cs.CR]; Réseaux et télécommunications [cs.NI]

Jean-Michel Combes, Ghada Arfaoui, Maryline Laurent. Dynamic DNS update security, based on cryptographically generated addresses and ID-based cryptography, in an IPv6 autoconfiguration context. AReS '12 : The 7th International Conference on Availability, Reliability and Security, Aug 2012, Prague, Czech Republic. pp.206-211, ⟨10.1109/ARES.2012.69⟩. ⟨hal-00756609⟩