A Formal-Specification Based Approach for Protecting the Domain Name System
نویسندگان
چکیده
Many network applic ationsdep end on the security of the domain name system (DNS). A ttackson DNS can cause denial of service and entity authentication to fail. In our appr oach,we use formal speci c ations to characterize DNS clients and DNS name servers, and to de ne a security goal: A name server should only use DNS data that is consistent with data from name servers that manage the corresponding domains (i.e., authoritative name servers). T o enfor cethe security goal, we formally specify a DNS wrapper that examines the inc oming and the outgoing DNS messages of a name server to dete ctmessages that could cause violations of the security goal, coop erates with the c orresponding authoritative name servers to diagnose those messages, and drops the messages that are identi ed as thr eats. Based on the wrapper sp eci c ation,we implemented a wrapper prototyp eand evaluated its performance. Our experiments show that thewr apper incurs r easonableoverhead and is e e ctive againstDNS attacks such as cache poisoning and certain spoo ng
منابع مشابه
Formal Method in Service Composition in Heath Care Systems
One of the areas with greatest needs having available information at the right moment and with high accuracy is healthcare. Right information at right time saves lives. Healthcare is a vital domain which needs high processing power for high amounts of data. Due to the critical and the special characteristics of these systems, formal methods are used for specification, description and verificati...
متن کاملA model for specification, composition and verification of access control policies and its application to web services
Despite significant advances in the access control domain, requirements of new computational environments like web services still raise new challenges. Lack of appropriate method for specification of access control policies (ACPs), composition, verification and analysis of them have all made the access control in the composition of web services a complicated problem. In this paper, a new indepe...
متن کاملDomain Based Internet Security Policy Management
Abstract. As security devices and protocols become widely used on the Internet, the task of managing and processing communication security policies grows steeply in its complexity. This paper presents a scaleable, robust, secure distributed system that can manage communication security policies associated with multiple network domains and resolving the policies — esp. those that specify the use...
متن کاملFormal specification, verification and correction of security policies based on the decision tree approach
Security components such as firewalls, IDS and IPS, are the mainstay and the most widely adopted technology for protecting networks. These security components are configured according to a global security policy. An error in a security policy either creates security holes that will allow malicious traffic to sneak into a private network or blocks legitimate traffic and disrupts normal business ...
متن کاملFormal Specification of Real-Time Requirements for Building Automation Systems
A generic approach to the formal specification of system requirements is presented. It is based on a pool of requirement patterns, which are related to design patterns well-known in object-oriented software development. The application of such patterns enhances the reusability and genericity as well as the intelligibility of the formal requirement specification. The approach is instantiated by ...
متن کامل