China's domain name services overall security situation stable and a small number of security problems still outstanding

March 4 News, recently, China Internet Network Information Center (CNNIC) and the national Domain Name Security Alliance issued the 2014 "China's Domain Name Service security situation and Situation Analysis report" (hereinafter referred to as the report), this is the national Domain name Security Alliance since its inception in March 2012, the 3rd " China Domain Name Service security status and Situation Analysis report. The paper reports the root Domain Name service system in the Internet Domain Name Service system of our country, the running state and security condition of the top-level domain Name service system, the two level and the authoritative Domain name services system and the recursive Domain Name Service system are comprehensively monitored and objectively evaluated, which reflects the security configuration and running state of each link Domain Name service system.

The report shows that through periodic repeated monitoring and analysis, the 2014 China's all levels of domain name servers using Linux/unix operating system is higher than 80%, the use of ISC BIND domain name resolution software is more than 90%, but more than 30% All levels of domain name servers used by the BIND software still supports version response, there are some security risks.

Data show that the root domain Name Service system for DNSSEC, IPV6, TCP and other related protocols, the highest level of support, 61 new mirror nodes, the average resolution speed up 20%. Top-level domain Name Service system related to the degree of support of the relevant agreement has been further strengthened, including DNSSEC support rate to 78%, the level of service redundancy further strengthened, a large number of new generic top-level domain to start external services. Global level Two and the following authoritative Domain Name service system in the relevant agreement to improve the degree of support is limited, but there is a more obvious improvement in the degree of service redundancy; For the domestic level two and the following authoritative domain Name service system, the correlation protocol support degree is relatively insufficient, but the service redundancy degree and the average resolution The recursive Domain Name Service system is still low in dnssec support, but the large packet support ratio is further enhanced.

Overall analysis of the report shows that the overall security situation of China's domain name service has risen steadily, and a small number of domain Name Service security issues remain outstanding.

The Domain Name Service system is an important infrastructure of the Internet, since 2009, CNNIC has started to monitor and analyze the configuration and security situation of the whole domain Name service system. CNNIC based on the national domain security monitoring platform of its own construction, this paper designs and develops the monitoring items of fault, configuration, performance and flow, so as to comprehensively monitor and objectively evaluate the running state and security condition of each link Domain Name service system.