Authentication of cache DNS server responses
A response to a Domain Name System (DNS) query can be protected with authentication information to be used by a host that originated the query. In one example, a DNS server is not among servers that can be authenticated by the Domain Name System Security Extensions (DNSSEC). The DNS server generates a public-private key pair and uses the private key for signing DNS resolutions. The corresponding public key can be distributed to hosts that will communicate with the DNS server. In various implementations, the public key is distributed by the DNS server and/or routers or as part of a neighbor discovery interaction. In one example, the public key is distributed in certificate path advertisements of the IPv6 Secure Neighbor Discovery Protocol (SEND) protocol.
1. A method comprising:
receiving, at a network node, a Domain Name System (DNS) server address certificate, wherein
the DNS server address certificate is received from a cache DNS server, and
the receiving the DNS server address certificate is a portion of a DNS server authentication process between the network node and the cache DNS server;
receiving, at the network node, a request from a host after the network node receives the DNS server address certificate, wherein
the request initiates a router authentication process; and
performing the router authentication process, in response to the request,
wherein
the router authentication process comprises transmitting a reply to the host,
the reply comprises authentication information,
the authentication information comprises a plurality of certificates,
the plurality of certificates comprises the DNS server address certificate,
the DNS server address certificate comprises an identifier of the cache DNS server and a public key of the cache DNS server.
2. The method of claim 1 , wherein the host is configured to authenticate a DNS resolution using the public key of the cache DNS server.
3. The method of claim 1 , wherein:
the network node comprises a router;
the host is coupled to the router via a data network;
the identifier of the cache DNS server comprises an address of the cache DNS server; and
the request and the reply are communications in a neighbor discovery protocol.
4. The method of claim 1 , wherein the request and the reply are communications in a Secure Neighbor Discovery Protocol (SEND) interaction.
5. The method of claim 4 , wherein:
the request is comprised in a SEND certificate path solicitation; and
the reply is comprised in a SEND certificate path advertisement.
6. The method of claim 1 , comprising:
receiving the public key of the cache DNS server from the cache DNS server; and
prior to transmitting the reply, authenticating the public key of the cache DNS server based at least in part on a trust anchor stored in the network node.
7. The method of claim 1 , comprising:
communicating a DNS query from the host to the cache DNS server; and
communicating a DNS resolution from the cache DNS server to the host, wherein
the DNS resolution is signed by a private key that corresponds to the public key.
8. The method of claim 7 wherein the DNS query comprises a name identifier and the DNS resolution comprises resolution information that is responsive to the DNS query, the method comprising:
communicating the name identifier from the cache DNS server to an authoritative DNS server;
communicating the resolution information from the authoritative DNS server to the cache DNS server; and
authenticating the resolution information using a Domain Name System Security Protocol (DNSSEC) authentication process.
9. The method of claim 1 wherein the request comprises a plurality of trust anchors.
10. The method of claim 1 wherein the plurality of certificates comprises a plurality of signatures, wherein the plurality of signatures can be used by the host to authenticate the network node.
11. A system comprising:
a communications interface; a memory; and
a processor configured, based at least in part on instructions stored in the memory,
to receive a Domain Name System (DNS) server address certificate,
wherein
the DNS server address certificate is received from a cache DNS server,
receiving the DNS address certificate is a portion of a DNS server authentication process between a network node and the cache DNS server;
store the DNS server address certificate in memory,
receive a request from a host after receiving the DNS server address certificate, wherein
the request initiates a router authentication process; and
perform the router authentication process, in response to the request,
wherein
the router authentication process comprises transmitting a reply comprising authentication information to the host,
the authentication information comprises a plurality of certificates,
the plurality of certificates comprises the DNS server address certificate, and
the DNS server address certificate comprises an identifier of the cache DNS server and a public key of the cache DNS server.
12. The system of claim 11 , wherein the host is configured to authenticate a DNS resolution using the public key of the cache DNS server.
13. The system of claim 11 , wherein:
the host and the communications interface are each coupled to a data network;
the cache DNS server is a non-authoritative DNS server; and
the address of the cache DNS server comprises a hash of the public key of the cache DNS server.
14. The system of claim 11 , wherein the request and the reply are communications in a Secure Neighbor Discovery Protocol (SEND) interaction.
15. The system of claim 14 , wherein:
a trust anchor is received in a SEND certificate path solicitation; and
the public key of the cache DNS server is transmitted in a SEND certificate path advertisement.
16. The system of claim 11 , wherein the processor is configured to:
receive the public key of the cache DNS server from the cache DNS server; and
authenticate the public key of the cache DNS server based at least in part on a trust anchor stored in the memory.
17. The system of claim 11 , wherein the processor is configured to:
convey a DNS query from the host to the cache DNS server; and
convey a DNS resolution from the cache DNS server to the host, wherein the DNS resolution is signed by a private key that corresponds to the public key.
18. The system of claim 17 wherein the DNS query comprises a domain name, the DNS resolution comprises an IP address, and the cache DNS server is configured to:
communicate the domain name to an authoritative DNS server; and
authenticate a reply from the authoritative DNS server using a Domain Name System Security (DNSSEC) authentication.
19. A non-transient computer-readable medium having instructions encoded therein, wherein the instructions are executable by one or more processors to perform acts comprising:
receiving, at a network node, a Domain Name System (DNS) server address certificate, wherein
the DNS server address certificate is received from a cache DNS server,
receiving the DNS address certificate comprises a portion of a DNS server authentication process between the network node and the cache DNS server;
storing the DNS server address certificate in memory;
receiving, at the network node, a request from a host, wherein
the request initiates a router authentication process; and
performing the router authentication process, in response to the request,
wherein
the router authentication process comprises transmitting a reply to the host,
the reply comprises authentication information,
the authentication information comprises a plurality of certificates,
the plurality of certificates comprises the DNS server address certificate, and
the DNS server address certificate comprises an identifier of the cache DNS server and a public key of the cache DNS server.