Enhanced secure dynamic DNS update with indirect route

In this paper, we present the design and implementation of the enhanced secure dynamic DNS update with indirect route (the IR DNS update). The existing DNS update may experience serious performance problem when the normal Internet route is unstable or unavailable due to DDoS attacks. By setting up indirect route via a set of proxy servers from the target side DNS server to the client side DNS server, the DNS zone data can be transported over Internet via the indirect routes to foil the DDoS attack. After the IR DNS update, the end users can get the indirect routing information by querying the DNS server, and set up indirect route to the target server accordingly. The IR DNS update is an essential part of the Secure Collective Defense (SCOLD) system, and it can be utilized independently as an extension to the existing DNS update utility. This technique can also be utilized to protect the root DNS servers from DDoS attacks. The implementation of the IR DNS update on BIND 9 is presented. The experimental results show that the IR DNS update can be used to improve the network security, availability and performance.