| 摘要: | 近年來網路科技日新月異，人手一台電腦和行動裝置已是常態。DNS 服務查詢的基 礎，提供使用者利用關鍵字搜尋或直接輸入網址的方式來去瀏覽各式網站和數位資 訊。然而，網路世界暗藏重重資訊安全隱憂，詐騙、釣魚網站的虛假內容層出不窮， 網路上的攻擊手法種類相當多，像是 DNS 服務阻斷攻擊、中間人攻擊、偽裝、反射/放 大攻擊、殭屍網路、惡意程式、資料外洩等等，其中又以阻斷攻擊(DoS)為最常見且 較容易實施的攻擊，利用龐大且密集的請求行為，使伺服器端無法負荷導致伺服器停 擺無法運作，造成眾多影響，此外，在 DNS 回應資料的穩定性和可用性也是在衡量 DNS 性能一個重要的指標。 有鑑於此，本文提出一種基於區塊鏈的去中心化 Domain Name System(DNS)解決方案，透過區塊鏈技術，DNS 記錄不再由單一 DNS Server 管理維護，而是儲存於 smart contract 上，將可具有不可篡改性，減少在傳統環境中的 DNS 快取中毒攻擊，並針對目前非常氾濫的 DDoS 攻擊上，本系統也能更好地防範針 對 DNS 的攻擊行為，提高可用性和系統整體效率，也設計能使使用者可以提供自身所 擁有的 DNS record，以電信業者為應用環境，維護其 DNS 對於該業者至關重要，我們 透過獎勵機制，增進使用者協助建立安全的 DNS 環境的意願，且在 DNS Record 上設 有時效性，並提供針對異常之 ip 進行註銷，更加提升資料的安全彈性。另外，在加強 效能上，本論文針對身份和資料驗證上採用 BBS+ Signature，由 Boneh、Boyen 和 Shacham 所提出的短簽名方案，他支援簽署多個訊息，同時產生單一輸出數位簽章， 且 BBS+ signature 在金鑰和簽章的的部分都較為輕量，可減少鏈上鏈下的資源消耗。;In recent years, network technology has been rapidly evolving, with personal computers and mobile devices becoming ubiquitous. DNS service queries provide the foundation for users to browse various websites and digital information through keyword searches or direct URL inputs. However, the internet world harbors numerous information security concerns, with fraudulent content from scams and phishing websites proliferating. There are various types of network attacks, such as DNS service denial attacks, man-in-the-middle attacks, impersonation, reflection/amplification attacks, botnets, malware, data breaches, etc. Among these, Denial of Service (DoS) attacks are the most common and easier to implement, using massive and intensive request behaviors to overwhelm servers, causing them to fail and cease operations, resulting in numerous impacts. Furthermore, the stability and availability of DNS response data are important indicators in measuring DNS performance.
In light of this, this paper proposes a blockchain-based decentralized Domain Name System (DNS) solution. Through blockchain technology, DNS records are no longer managed and maintained by a single DNS Server, but are stored on smart contracts, ensuring immutability and reducing DNS cache poisoning attacks in traditional environments. Regarding the currently rampant DDoS attacks, this system can better prevent attacks targeting DNS, improving availability and overall system efficiency. It is also designed to allow users to provide their own DNS records. In the context of telecommunications providers, maintaining their DNS is crucial. We implement a reward mechanism to enhance users′ willingness to assist in establishing a secure DNS environment. Additionally, DNS Records have a time- based validity and provide the ability to revoke abnormal IP addresses, further enhancing data security flexibility.
Moreover, to enhance performance, this thesis adopts BBS+ Signature for identity and data verification. This short signature scheme proposed by Boneh, Boyen, and Shacham supports signing multiple messages while generating a single output digital signature. BBS+ signature is more lightweight in both key and signature aspects, reducing on-chain and off-chain resource consumption. |
