CPU load analysis for DNSSEC deployment and realization techniques of a large-scale DNS server

摘要

Domain Name System (DNS) which used to resolve hostname to IP address in the Internet has vulnerability of well-known spoofing attack. Therefore, DNS Security Extensions (DNSSEC), which authenticate reply message's origin using the digital signature, is proposed. However, when we deploy DNSSEC, the amount of load of DNS server will be increased by the overhead of the authentication processes. In this paper, we evaluate CPU loads of two kinds of name servers and approximate a time of generating a zonefile. And we show that a process of generating zonefile can be parallelized and we approximate its time. As a consequence of such evaluations, we show a guideline to deploy DNSSEC for large scale zone.