A Metapolicy Framework for Enhancing Domain Expressiveness on the Internet

Gaurav Varshney,Pawel Szalachowski

DOI: https://doi.org/10.48550/arXiv.1804.04274

2018-04-12

Abstract:Domain Name System (DNS) domains became Internet-level identifiers for entities (like companies, organizations, or individuals) hosting services and sharing resources over the Internet. Domains can specify a set of security policies (such as, email and trust security policies) that should be followed by clients while accessing the resources or services represented by them. Unfortunately, in the current Internet, the policy specification and enforcement are dispersed, non-comprehensive, insecure, and difficult to manage. In this paper, we present a comprehensive and secure metapolicy framework for enhancing the domain expressiveness on the Internet. The proposed framework allows the domain owners to specify, manage, and publish their domain-level security policies over the existing DNS infrastructure. The framework also utilizes the existing trust infrastructures (i.e., TLS and DNSSEC) for providing security. By reusing the existing infrastructures, our framework requires minimal changes and requirements for adoption. We also discuss the initial results of the measurements performed to evaluate what fraction of the current Internet can get benefits from deploying our framework. Moreover, overheads of deploying the proposed framework have been quantified and discussed.

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is that the specification and implementation of domain name security policies in the current Internet are scattered, incomplete, insecure and difficult to manage. Specifically:

1. **Inexpert Users**: When user participation in decision - making is required, most users do not have sufficient professional knowledge to make correct security decisions. For example, users may not notice the security indication icons in the browser, or ignore browser warnings and click through directly.

2. **Lack of Policy Customization**: Due to scale reasons, software vendors and the Internet community can only introduce general global policies and cannot customize according to the needs of specific domain names. This may lead to some websites (such as news or information websites) wishing to relax security policies to display content and advertisements, while bank websites require stricter security policies.

3. **Inconsistent Policy Implementation**: Policies implemented by different software may be inconsistently implemented due to developers' choices, resulting in users being able to evade policy errors by switching browsers.

4. **Downgrade Attacks**: Man - in - the - middle attackers can strip policy header information, leading to downgrade attacks. For example, malicious browser extensions can modify or delete HTTP header information, thus undermining the security policies at the application layer.

5. **Insufficient Expression of Existing Policies**: Although some security policies have been expressed through domain names, Internet security can benefit from more security policies being more easily expressed and managed through domain names.

To solve these problems, the author proposes a meta - policy framework that allows domain name owners to specify, manage and publish their domain - level security policies through the existing DNS infrastructure and utilize the existing trust infrastructure (such as TLS and DNSSEC) to provide the necessary security. This framework aims to improve the expressiveness of domain names on the Internet while ensuring security and ease of use.