PREFETCHing to overcome DNSSEC deployment over large resolving platforms

Daniel Migault (1) , Stéphane Sénécal (1) , Stanislas Francfort (1) , Emmanuel Herbert (2, 3, 4) , Maryline Laurent (2, 3, 4)

1 Orange Labs [Issy les Moulineaux]
2 TSP - RST - Département Réseaux et Services de Télécommunications
3 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
4 CNRS - Centre National de la Recherche Scientifique

Todays' DNS resolving platforms have been designed for DNS with fast and light resolutions over the Internet. With signature checks and larger payload, experimental measurements [10] showed that DNSSEC resolutions require up to 4 times more CPU. While DNSSEC requires more CPU than DNS, this paper proposes PREFETCHX, an architecture that optimizes the use of CPU and thus avoids that resolving platforms increase their size for DNSSEC migration. Current resolving platforms IPXOR split the traffic between the nodes according to the IP addresses. Alternatively, PREFETCHX takes advantage of the FQDN's popularity distribution (Zipf), a layered cache and cache sharing mechanisms between the nodes and requires at least 4 times less nodes. Furthermore PREFETCHX does not impact the network infrastructure which eases its deployment. Then, defining X the number of prefetched FQDNs makes PREFETCHX highly scalable and flexible to different type of traffic

Mots clés: DNS; DNSSEC; DHT; Pastry; Cache sharing

Domaines: Architectures Matérielles [cs.AR]; Cryptographie et sécurité [cs.CR]; Performance et fiabilité [cs.PF]

Daniel Migault, Stéphane Sénécal, Stanislas Francfort, Emmanuel Herbert, Maryline Laurent. PREFETCHing to overcome DNSSEC deployment over large resolving platforms. TRUSTCOM 2013 : 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, Jul 2013, Melbourne, Australia. pp.694 - 703, ⟨10.1109/TrustCom.2013.84⟩. ⟨hal-01262120⟩