Acceleration of a Client Based DNSSEC Validation System in Parallel with Two Full-Service Resolvers

Domain Name System Security Extensions (DNSSEC) is an effective solution for mitigating DNS cache poisoning attacks but it also has many issues on real operations. In the literature, a client based DNSSEC validation system has been proposed in order to solve some existing issues by running DNSSEC validation on each end client. However, in the system, the DNS responses with successful validation will be only used by each end client thus without sharing it with other end clients. In this paper, we propose an acceleration method for the client based DNSSEC validation system by using two different types of external DNS full-service resolvers (DNSSEC-enabled and DNSSEC-disabled) in parallel. As a result, the performance of domain name resolution can be improved by sharing the DNS responses with successful DNSSEC validation. Furthermore, when the domain name resolution on the DNSSEC-enabled external DNS full-service resolver ends with timeout or failure, the end client conducts the DNSSEC validation by itself by querying necessary DNS records to the DNSSEC-disabled external DNS full-service resolver and also a pop-up alert message will warn the users if the DNSSEC validation fails. We implemented a prototype system and evaluated the features as well as the performance of the proposed method. The results confirmed that the proposed method achieved high performance in domain name resolution.