GB/T 33562-2017Information security technology—Secure domain name system deployment guide (English PDF)

Foreword

This standard is drafted in accordance with the rules given in GB/T 1.1-2009.

Introduction

With the development of network attack technology and the frequent occurrence of DNS vulnerabilities, the attacker has greatly shortened the hijacking DNS search process The time required for any step, so that the control of the session can be made faster to implement some kind of malicious operation. To eliminate this in the long run The only solution is to deploy the DNSSec protocol in an end-to-end form, that is, from the root zone to the final domain name. Are deployed DNSSec.

Currently, DNSSec services have been deployed as root servers for the DNSSec trust chain. At the same time, with the industry on DNSSec Efforts to promote the top-level domain name management agencies have begun to deploy DNSSec services, but in the top-level domain under the secondary authority and recursive Domain support for DNSSec is relatively low. Although the domestic focus on the authority of the domain name server and the main recursive domain name server support for DNSSec Only 0.9% and 2.2%, but their support for DNSSec has improved significantly compared to the previous.

This standard provides domain name system DNSSec deployment process for the authority of the domain name system security guide, recursive domain name system security guide, DNS Transaction Security Guide and DNS Data Security Guide DNS Security Technical Guide for DNSSec Deployment to Domain Name Domains Technical support and practice guidance.

1 Scope

This standard specifies the domain name system security extension protocol (DNSSec) deployment process authority domain name system security, recursive domain name system security Full, DNS transaction security, DNS data security and other DNS security technology guide.

This standard applies to the domain name system within the organization of the domain name system security management personnel.

2 Normative reference documents

The following documents are indispensable for the application of this document. For dated references, only the dated edition applies to this document. For undated references, the latest edition (including all modifications) applies to this document.

GB/T 5271.8-2001 Information technology - Vocabulary - Part 8: Security

GB/T 5271.9-2001 Information technology - Glossary - Part 9: Data communication

GB/T 25069-2010 Information security technical terminology

GB/T 33134-2016 Information security technology - Public domain name service system - Security requirements

YD/T 2137-2010 Technical requirements for recursive server operation of domain name system

YD/T 2138-2010 Technical Requirements for Authoritative Server Operation of Domain Name System

YD/T 2140-2010 Technical Requirements for Security Framework of Domain Name Service

YD/T 2586-2013 Domain Name Service System Security Extension (DNSSec) Protocol and Implementation Requirements

3 Terms and definitions

GB/T 5271.8-2001, GB/T 5271.9-2001, GB/T 25069-2010 The definitions and the following terms and definitions apply to this document.