Ukuphepha kwe-DNSSEC kanye ne-DNS kunethiwekhi yakho yendawo

Informatec Digital » Izinsiza » Ukuphepha kwe-DNSSEC kanye ne-DNS kunethiwekhi yakho yendawo

I-inthanethi yakhelwe phezu kwezingxenye ezimbalwa ezibalulekile esingakaze sizibone, kodwa ezikhona njalo uma sivula isiphequluli. Enye yezinto ezibaluleke kakhulu yi-Domain Name System (DNS), futhi uma sikhuluma nge- DNSSEC nokuphepha kunethiwekhi yendawo , sikhuluma ngokuqinisa leso sisekelo ukuze kuvinjelwe ukuqondisa kabusha okukhohlisayo, ukukhwabanisa, nokunye ukuhlaselwa okungathi sína.

Ngaphambilini, okwakubalulekile kwakuwukuqinisekisa ukuthi konke kuyasebenza; namuhla siyazi ukuthi lokho akwanele. I-DNS yazalwa ngawo-80 ngaphandle kokucabanga ngokuhlaselwa okukhulu kwe-cyber, kodwa manje sidinga ukuthi ingaxazululi amagama kuphela kodwa futhi iqinisekise ubuqiniso nobuqotho bempendulo ngayinye . Yilapho i-DNSSEC ingena khona, futhi muva nje, iziphakamiso ezifana ne-E-DNSSEC, ezihlose ukwengeza ubumfihlo futhi—isici esibalulekile uma ukhathazekile ngokuphepha kwenethiwekhi yakho yendawo noma yenkampani.

Iyini i-DNS futhi kungani ibaluleke kangaka ekuphepheni?

I- Domain Name System (DNS ) iyincwadi yocingo ye-inthanethi: ihumusha amagama okulula ukuwakhumbula (njenge-www.example.com) abe amakheli e-IP ezinombolo aqondwa amakhompyutha (isibonelo, i-192.168.2.15 noma ikheli le-IPv6). Ngaphandle kwale ndlela, bekuzodingeka sibambe ngekhanda izinombolo esikhundleni samagama, okuyinto engasebenzi nhlobo.

Le ngqalasizinda ihlelwe njengesizindalwazi esisatshalaliswe esakhiweni sesihlahla , esinesizinda sempande phezulu, kulandelwe izizinda eziphezulu (ama-TLD afana ne-.es, .com, .org), futhi ngaphansi kwalokho, izizinda kanye nezizinda ezincane. Ingxenye ngayinye yale sizindalwazi ibizwa ngokuthi " indawo " futhi ibanjwe kumaseva egama elilodwa noma ngaphezulu anegunya, ashicilela ulwazi "olusemthethweni" lwesizinda ngasinye.

Uma ikhompyutha yakho, ifoni ephathekayo, noma enye idivayisi ifuna ukufinyelela iwebhusayithi, iqala ngokubuza i- stub resolver , eyingxenye yesistimu yokusebenza. Lesi sixazululi sithumela umbuzo kuseva ye-DNS ephindaphindayo (ngokuvamile umhlinzeki wakho wesevisi ye-inthanethi, inkampani yakho, noma yomphakathi njenge -Google Public DNS , i-OpenDNS, noma i-Quad9). Lesi sixazululi siphinde sifune impendulo ngokubuza amaseva amaningana agunyaziwe kuze kube yilapho sithola ikheli le-IP elifanele.

Abaxazululi abaphindaphindayo bagcina izimpendulo abazitholayo ukuze basheshise imibuzo elandelayo. Lokhu kusebenza kahle kakhulu, kodwa futhi kuvula ithuba lokuthi umhlaseli "afake ubuthi ku-DNS cache" futhi afake idatha engamanga , ukuze izicelo eziningi ezilandelayo zixazululwe ngalolu lwazi olushintshiwe ngaphandle kokuqaphela komsebenzisi.

Inkinga enkulu ukuthi, ekwakhiweni kwayo kwasekuqaleni, i-DNS ayinayo indlela eqinile yokuqinisekisa ubuqiniso bezimpendulo . Isixazululi empeleni sihlola ukuthi impendulo ibonakala ivela ekhelini elifanayo le-IP elibuzile, kodwa lelo kheli le-IP lomthombo lingaphanjwa kalula. Lokhu kuvumela ukuhlasela okuqondiswe buthule kumasayithi okukhwabanisa alingisa, isibonelo, iwebhusayithi yebhange lakho.

Imikhawulo yokuphepha ye-DNS yendabuko

Iphrothokholi ye-DNS yadalwa enkathini lapho ukuphepha kwakungeyona into ebaluleke kakhulu. Yingakho manje sesiyazi ukuthi imibuzo nezimpendulo ze-DNS zihamba ngombhalo ocacile , ngaphandle kokubethela, nokuthi idatha yerekhodi ingashintshwa ngaphandle kokuvikelwa okwengeziwe.

Lokhu kuvula ithuba lokuhlasela ngezinhlobo eziningana, ikakhulukazi ubuthi be-DNS cache kanye nokuhlasela komuntu ophakathi nendawo. Kuzo zombili izimo, umhlaseli ufaka izimpendulo mbumbulu endleleni, okwenza abasebenzisi bagcine bekwiwebhusayithi elawulwa yibo ngaphandle kokuqaphela noma yini engavamile, njengoba igama lesizinda eliboniswe kusiphequluli lihlala lisemthethweni.

Cabanga ukuthi ungena kuwebhusayithi yebhange lakho: ikhompyutha yakho icela ikheli le-IP lesizinda sebhange kusuka kuseva ephindaphindayo, kodwa umhlaseli ukhohlise iseva ukuthi yamukele impendulo engamanga enekheli le-IP lewebhusayithi efanayo elawulwa yiyo . Umsebenzisi ufaka iziqinisekiso zakhe, ecabanga ukuthi konke kujwayelekile, bese isigebengu se-inthanethi sizithola ngombhalo ocacile ukuze sizisebenzise kusayithi langempela kamuva.

Izindlela ezifana ne -Transaction Signatures (TSIG) , ezichazwe ku-RFC 2845, zisebenza ukuvikela imisebenzi ethile phakathi kwamaseva e-DNS (isibonelo, ukudluliselwa kwendawo phakathi kwamaseva e-master kanye ne-slave kanye nezibuyekezo ezishintshashintshayo). I-TSIG ivumela imishini emibili ukwabelana ngokhiye oyimfihlo ukuqinisekisa ubunikazi bolunye uhlangothi kanye nobuqotho bemiyalezo edluliswayo.

Kodwa-ke, i-TSIG inobubanzi obulinganiselwe kakhulu: ayiqinisekisi umsuka "wangempela" wedatha ye-DNS ; iqinisekisa kuphela ukuthi ukushintshana phakathi kwamaseva amabili athile akuphazanyiswanga. Uma ulwazi lokuqala endaweni ethile seluvele luphazamisekile noma lushintshiwe ngaphambi kokufinyelela lawo maseva, i-TSIG ngeke iluthole. Ngakho-ke, yize ivame ukusetshenziswa ekudlulisweni kwezindawo, ayixazululi inkinga eyisisekelo yobuqiniso bedatha ye-DNS eshicilelwe.

Iyini i-DNSSEC futhi iyinikela ngani ekuphepheni?

Ngenxa yabo bonke lobu buthakathaka, kwasungulwa i-Domain Name System Security Extensions (DNSSEC) . I-DNSSEC ayithathi indawo ye-DNS yakudala, kodwa iyayandisa ngesendlalelo sokuphepha esivumela ukuqinisekiswa ukuthi idatha etholiwe isemthethweni futhi ayishintshwanga.

I-DNSSEC isekelwe ku -cryptography yokhiye womphakathi (i-cryptography engalingani) . Indawo ngayinye ye-DNS inezihluthulelo ezimbili: ukhiye oyimfihlo, ogcinwa uyimfihlo, kanye nokhiye womphakathi, oshicilelwa kuseva ye-DNS uqobo. Umnikazi wendawo usebenzisa ukhiye oyimfihlo ukusayina amarekhodi ngedijithali kuleyo ndawo; ukhiye womphakathi usetshenziselwa ukuqinisekisa lawo masignesha.

Uma iseva ephindaphindayo ibuza isizinda esebenzisa i-DNSSEC, kanye nolwazi olujwayelekile (isibonelo, ikheli le-IP elihlotshaniswa negama), ithola neziginesha zedijithali nezikhiye zomphakathi ezidingekayo ukuze kuqinisekiswe . Iseva ephindaphindayo iqinisekisa iziginesha ngokumelene nezikhiye zomphakathi ezishicilelwe; uma ukuqinisekiswa kuphumelele, idatha ibhekwa njengeyiqiniso futhi ingashintshiwe selokhu yasayinwa.

Uma ukuqinisekiswa kwehluleka, umxazululi uyaqonda ukuthi kukhona okungahambi kahle (isibonelo, ukuzama ukukhwabanisa noma ukuphazamisa ukuthutha) bese ephendula iklayenti ngekhodi yephutha, ngokuvamile i-SERVFAIL . Ngale ndlela, umsebenzisi akatholi idatha engaba yingozi, yize ngokombono wakhe, konke azokubona ukuthi ikhasi "alilayishi" noma libonisa iphutha.

I-DNSSEC iphinde yethule umqondo wochungechunge lwe-trust , olusebenzisa uhla lwe-DNS olukhona. Indawo eyinhloko isayina okhiye bezizinda eziphezulu (njenge-.es, .com), lezi zisayina okhiye bezizinda zazo ezincane, njalo njalo, ukuze noma yisiphi isizinda siqinisekiswe kusetshenziswa iphuzu elilodwa lokuthembela: ukhiye womphakathi wendawo eyinhloko.

Izihluthulelo ze-KSK ne-ZSK, amarekhodi, kanye nochungechunge lokwethenjwa

Ukuze uhlele kangcono ukuphepha, i-DNSSEC isebenzisa izinhlobo ezimbili ezahlukene zezihluthulelo: i -Key Signing Key (KSK) kanye ne- Zone Signing Key (ZSK) . Nakuba ngokwezobuchwepheshe zifana (ngokukhuluma nge-cryptographic), umsebenzi wazo uhlukile ngaphakathi kwesistimu.

Ukhiye we-ZSK usetshenziselwa ukusayina wonke amarekhodi ezinsiza endaweni (A, AAAA, MX, njll.). Ngokuvamile ujikeleziswa njalo ukuze kuncishiswe ingozi, njengoba noma yikuphi ukuyekethisa kwalesi sikhiye kungathinta wonke amarekhodi endaweni. I-KSK, ngakolunye uhlangothi, isetshenziswa kakhulu ukusayina ukhiye wendawo (ZSK) uqobo, futhi i-hash yayo ishicilelwa njengerekhodi le -DS (Delegation Signer) endaweni yomzali.

Ngenxa yalokhu kuhlukaniswa kwezindima, ukushintsha i-ZSK kulula: vele udale i-ZSK entsha, uyisayine ne-KSK, uyishicilele kumarekhodi e-DNSKEY endawo, bese uvumela abaxazululi ukuthi bavuselele ulwazi lwabo. Asikho isidingo sokuthinta indawo yomzali, njengoba i-DS iqhubeka nokukhomba i-KSK efanayo, ehlala izinzile isikhathi eside.

I-DNSSEC inezela izinhlobo eziningana zamarekhodi athile kuphrothokholi ye-DNS, eyenzelwe ukusekela ukusayinwa kwedatha nokuqinisekiswa kwayo. Phakathi kwezibaluleke kakhulu yi -DNSKEY, RRSIG, DS, NSEC/NSEC3, kanye ne-NSEC3PARAM . Konke lokhu kukuvumela ukuthi wakhe i-logic yokuqinisekisa ngaphandle kokushintsha ukusebenza okuyisisekelo kwemibuzo.

Irekhodi le-DNSKEY ligcina ukhiye womphakathi wendawo , okudingekayo ukuqinisekisa amasignesha. Irekhodi le-RRSIG liqukethe isignesha yedijithali ehlotshaniswa nesethi ethile yamarekhodi ("Isethi Yerekhodi Lezinsiza"). Irekhodi le-DS liyi-hash ye-DNSKEY yendawo yengane, enyatheliswa endaweni yomzali futhi isebenza njengesixhumanisi ochungechungeni lokwethenjwa.

Amarekhodi e-NSEC kanye ne-NSEC3 asetshenziselwa ukunikeza ukuphika okuqinisekisiwe kokuba khona ; okungukuthi, ukufakazela ngokwe-cryptographic ukuthi igama lesizinda noma irekhodi alikho, ukuvimbela ukuhlaselwa okuzama ukungena ezimpendulweni ezingamanga ezibonisa ukuthi kukhona okungekho lapho kukhona khona ngempela (noma okuphambene nalokho).

Uchungechunge lokuthembana kanye nokuqinisekiswa kwempendulo ye-DNSSEC

I-chain of trust ebizwa ngokuthi i-DNSSEC yakhiwe ngokuxhumanisa amarekhodi e-DNSKEY kanye ne-DS kusukela empandeni kuya kusizinda esifuna ukusiqinisekisa . Indawo yokuqala ukhiye womphakathi we-root zone, osebenza njenge-trust anchor futhi ngokuvamile ulungiselelwa ngqo kuma-recursive resolvers.

Isibonelo, uma ufuna ukuqinisekisa isizinda esifana ne-mywebsite.es, inqubo enengqondo izoba yile: i-resolver ithembela kukhiye womphakathi wempande, osayina ukhiye we-.es; indawo ye-.es ishicilela irekhodi le-DS elihambisana nokhiye we-mywebsite.es KSK; ngokuqinisekisa leyo DS ngokhiye we-.es, i-resolver ithembela ku-mywebsite.es DNSKEY futhi, kusukela lapho, ingaqinisekisa ama-RRSIG kuwo wonke amarekhodi ayo.

Uma isiginesha esivumelekile singekho kunoma iyiphi indawo kuchungechunge, noma uma i-DS (Data Signature) ingekho lapho kufanele ibe khona, uchungechunge lokwethenjwa luphukile. Kuleso simo, iseva ephindaphindayo eyenza ukuqinisekiswa ayibheki idatha njengephephile futhi, kuye ngokucushwa kwayo, ayiphenduli ngamarekhodi aceliwe noma imake impendulo njengengavumelekile.

Lobu budlelwano obuhambisana nohlu lwezikhundla busho nokuthi, ukuze i-DNSSEC isebenze kahle ngempela, akwanele ukusayina indawo yakho kuphela : indawo yomzali (isibonelo, ama-.es) kanye nendawo yempande kumele kusayinwe futhi kushicilelwe amarekhodi azo e-DNS ngendlela efanele. Njengamanje, indawo yempande ye-DNS kanye cishe nawo wonke ama-domain ajwayelekile aphezulu (ama-gTLD) kanye nama-domain amaningi aphezulu ekhodi yezwe (ama-ccTLD) asesayiniwe kakade.

Uma iseva ephindaphindayo ene-DNSSEC evunyelwe ithola ukuthi isiginesha ayifani noma ukuthi isixhumanisi asikho, impendulo eyibuyisela kuklayenti ivame ukuhambisana nekhodi yephutha le-RCODE SERVFAIL. Lokhu kungaba yinto edidayo kumsebenzisi wokugcina ("iwebhusayithi ayisebenzi"), kodwa ngokombono wokuphepha, kuyindlela yokuvikela idatha engase ishintshwe.

I-DNSSEC iphinde yethule izici ezimbili ezibalulekile: ukuqinisekiswa komsuka wedatha , okuvumela ukuqinisekiswa ukuthi amarekhodi avela endaweni elindelwe, kanye nokuvikelwa kobuqotho , okuqinisekisa ukuthi ulwazi aluzange lushintshwe selokhu lwasayinwa ngumnikazi wendawo ngokhiye wakhe wangasese.

Ukuhlaselwa okuncishiswe yi-DNSSEC kanye nobudlelwano babo ne-TLS/HTTPS

Ukusebenzisa i-DNSSEC kusiza ekuvikeleni ezinsongweni eziningana ezivamile. Okokuqala, kwenza ukukhwabanisa impendulo ye-DNS kube nzima kakhulu , njengoba umhlaseli kuzodingeka akhiqize amasignesha avumelekile ngaphandle kokwazi ukhiye wangasese wendawo, okuyinto engenakwenzeka ngokwe-cryptographic uma okhiye bephathwa kahle.

Ngaphezu kwalokho, i-DNSSEC inciphisa ingozi yokuba nesifo se-cache kumaseva aphindaphindayo ngokuvimbela ukwamukelwa kwezimpendulo eziguquliwe ezihluleka ukuqinisekiswa kwesiginesha. Iphinde yenze kube nzima ukuhlaselwa kwe-man-in-the-middle (MITM) kuthrafikhi ye-DNS, lapho umhlaseli eguqula khona izimpendulo lapho edlula: uma impendulo yehluleka ukuqinisekiswa, umxazululi uyayilahla.

Nokho, kubalulekile ukuqonda lokho i-DNSSEC engenzi. Lezi zandiso aziklanyelwe ukubethela okuqukethwe kwemibuzo noma izimpendulo . Yonke ithrafikhi ye-DNS, ngisho ne-DNSSEC, isahamba ngombhalo ocacile ngaphandle kokuthi usebenzisa obunye ubuchwepheshe obuhambisanayo (njengezixazululo ze-DoT, DoH, noma i-E-DNSSEC). I-DNSSEC igxile ekuqinisekiseni ukuthi lokho okutholayo kuyiqiniso futhi akushintshwanga, hhayi ekufihleni lokho okucelayo.

Lokhu kuyenza ihluke ngokusobala kumaphrothokholi afana ne -TLS kanye ne-HTTPS . Ngenkathi i-HTTPS ibhala ngemfihlo ithrafikhi phakathi kwesiphequluli kanye neseva yewebhu ukuvimbela abantu besithathu ekuhloleni noma ekuguquleni ukuxhumana, i-DNSSEC imane isayine idatha ye-DNS ukuze ithole ukukhohlisa. Isayithi lingaba ne-HTTPS ngaphandle kwe-DNSSEC noma i-DNSSEC ngaphandle kwe-HTTPS, kodwa inhlanganisela yakho kokubili inikeza isivikelo esibanzi kakhulu ekuhlaseleni nokukhohlisa.

Izinhlangano ezifana ne-ICANN kanye ne-IETF bezilokhu zikhuthaza ukwamukelwa kabanzi kwe-DNSSEC yizikhungo zokubhalisa, ababhalisi, ama-ISP, kanye nabaqhubi benethiwekhi iminyaka eminingi. Umgomo uwukuthi kusayinwe izindawo eziningi futhi abaxazululi abaningi baziqinisekise ngenkuthalo, ukuze umsebenzisi ojwayelekile azuze kulezi ziqinisekiso ze-cryptographic ngaphandle kokuthatha noma yisiphi isinyathelo esikhethekile.

I-DNSSEC ezizindeni ze-.es kanye nezibopho zomnikazi

Esimweni esithile saseSpain, iyunithi ye-".es" Domains ephethwe yi-Red.es isikhathi eside ifaka ubuchwepheshe nezinqubo ezengeziwe zokuthuthukisa ikhwalithi nokuphepha kwesevisi ye-DNS ngaphansi kwekhodi yezwe ye-.es. Phakathi kwalezi zinyathelo kukhona ukusetshenziswa kwephrothokholi yokuphepha ye-DNSSEC ngokuhambisana nezincazelo ze-IETF.

Ama-domain e-.es anesibopho sokusayina indawo ephezulu ye-.ES nokuthola imvume kusuka empandeni ye-DNS, ngaleyo ndlela ahlanganiswe nochungechunge lwe-trust lomhlaba wonke. Lokhu kusho ukuthi uma une-domain ye-.es, ungasebenzisa le ngqalasizinda ukuvikela i-domain yakho nge-DNSSEC.

Njengomnikazi wesizinda, inqubo evamile yokuvumela i-DNSSEC ihilela ukuqinisekisa ukuthi amaseva akho e-DNS agunyaziwe ashicilela indawo esayiniwe. Ngokuvamile, lokhu kuhilela ukukhiqiza ukhiye womphakathi wendawo yakho, ukusayina amarekhodi, ukushicilela ukhiye we-DNS, bese uthumela izinto ezibalulekile (noma irekhodi le-DS uqobo) kurejista noma kumbhalisi wakho ukuze bakwazi ukudala irekhodi le-DS elihambisanayo endaweni yomzali.

Empeleni, abahlinzeki abaningi be-DNS hosting kanye nababhalisi kakade banikeza inketho elula yokunika amandla i-DNSSEC, ngezinye izikhathi kulula njengokuhlola ibhokisi kuphaneli yokulawula. Kodwa-ke, kungase kube nezindleko ezincane zonyaka ezihlobene nalokhu kusebenza, kuye ngokuthi umhlinzeki kanye nezinga lesevisi.

Uma indawo isisayiniwe futhi i-Domain Name System (DNS) isishicilelwe ngempumelelo, isizinda sakho siba yingxenye yochungechunge lwe-DNSSEC lokwethenjwa. Kusukela ngaleso sikhathi kuqhubeke, izinqumo ze-DNS zesizinda sakho zingaqinisekiswa ngokwe-cryptographic ngabaxazululi abanikwe amandla okuqinisekiswa kwe-DNSSEC, okwandisa ukwethenjwa komsebenzisi futhi kuncishiswe ingozi yokuhlaselwa kobuqili.

I-DNSSEC kunethiwekhi yendawo: ukuqinisekiswa kohlangothi lomsebenzisi

Ngokombono womsebenzisi wokugcina noma inkampani ekhathazekile ngokuphepha kwenethiwekhi yayo yendawo, umbuzo obalulekile uwukuthi: yini edingekayo ukuze uzuze ku-DNSSEC? Izindaba ezinhle ukuthi awudingi ukumisa noma yini kukhompyutha ngayinye , inqobo nje uma iseva yakho ye-DNS ephindaphindayo (leyo esetshenziswa amakhompyutha akho) iqinisekisa i-DNSSEC.

Ukuze wenze lokhu, okudingayo nje ukuthi umhlinzeki wakho we-DNS (i-ISP yakho, i-resolver yomphakathi, noma i-DNS yangaphakathi yenhlangano yakho) abe neseva ephindaphindayo enokuqinisekiswa kwe-DNSSEC okunikwe amandla futhi okulungiselelwe kahle . Cishe bonke abaxazululi besimanje basekele i-DNSSEC iminyaka; ukuyivumela kuvame ukuhilela izinguquko ezimbalwa kuphela kufayela labo lokucushwa kanye nokwengeza i-root trust anchor.

Uma ukuqinisekiswa sekuvuliwe, lapho enye yamakhompyutha akho kunethiwekhi yendawo ibuza isizinda esisayiniwe, i-recursive resolver iqinisekisa wonke amasignesha kanye nochungechunge lokwethembana ngaphambi kokubuyisela impendulo. Uma kukhona okungahambisani, ayibuyisi marekhodi, futhi umsebenzisi ubona iphutha, okumvimbela ngempumelelo ekuxhumekeni kusayithi elingase libe yinkohliso.

Ukuze uhlole ukuthi isizinda sakho sivikelwe yi-DNSSEC, kunezindlela eziningana ezitholakalayo ku-inthanethi, njenge -DNSSEC Analyzer kanye nezinye izinsiza zokuqinisekisa . Uma ufaka isizinda sakho, kufanele ubone amarekhodi afana ne-RRSIG (amasiginesha e-cryptographic), i-DNSKEY (izihluthulelo zomphakathi), kanye ne-DS (i-hash ye-DNSKEY endaweni yomzali). Uma ithuluzi libonisa ukuthi akukho siginesha yedijithali ehlotshaniswa namarekhodi, isizinda sakho sizobhekwa njenge-"esingasayiniwe" noma "esingavikelekile."

Uma, ngemva kwalokhu kuhlola, uthola ukuthi isizinda sakho noma amaseva e-DNS owasebenzisayo kunethiwekhi yakho yendawo awasebenzisi i-DNSSEC, kungcono ukuxhumana nomhlinzeki wakho wesevisi noma i-ISP ukuze ucele ukuthi isebenze. Uma benganikezi le nketho, kungaba yisikhathi esihle sokucabanga ngokushintshela kumhlinzeki osekela ukuqinisekiswa kwe-DNSSEC, ngaleyo ndlela kwandiswe izinga lokuphepha kokubili enkampanini yakho nakumakhasimende akho.

Imikhawulo ye-DNSSEC: ubumfihlo nezinye izici

Naphezu kwazo zonke izinzuzo zayo, i-DNSSEC ayiyona insiza yomlingo yazo zonke izinkinga zokuphepha ze-DNS. Inkinga ebalulekile ukuthi ayinikezi ubumfihlo bemibuzo . Amaphakethe e-DNS, ngisho nakuyi-DNSSEC, asahamba ngombhalo ocacile, ngakho-ke noma ubani onokufinyelela kuthrafikhi (isibonelo, kunethiwekhi yomphakathi engavikelekile ye-Wi-Fi ) angabona ukuthi yiziphi izizinda ezibuzwayo.

Futhi ayinikezi ukulawula kokufinyelela noma ukuzivikela okuqondile ekuhlaselweni kokunqatshelwa kwenkonzo (i-DoS noma i-DDoS) . Eqinisweni, ngokungeza idatha eyengeziwe (amasignesha, okhiye, amarekhodi engeziwe), kwandisa usayizi wezimpendulo ze-DNS, ezingasetshenziswa ekuhlaselweni kokukhulisa uma ingqalasizinda ingalungiselelwanga futhi ingavikelwe kahle.

Ngakolunye uhlangothi, i-DNSSEC yethula ubunzima bokusebenza: ama-key pair kumele aphathwe, i-ZSK ne-KSK kumele zijikeleziswe, ukushicilelwa kwe-DS endaweni yomzali kumele kuhlanganiswe , futhi kumele kuqinisekiswe ukuthi akukho ukungafani okuphula uchungechunge lokwethembana. Iphutha kulezi zinqubo lingabangela ukuthi isizinda siyeke ukuqinisekisa ngendlela efanele, okubangela ukungasebenzi kahle kwesevisi.

Ngaphakathi kwenqubo ye-DNSSEC ngokwayo, kunezingcezu zokulawula emilayezweni (njenge-CD bit emibuzweni kanye ne-AD bit ezimpendulweni) ezithonya indlela ukuqinisekiswa okwenziwa ngayo nokubikwa ngayo. Umhlaseli ongakwazi ukuphatha lezi zingcezu endaweni engaphephile angazama ukwehlisa isithunzi sokuvikelwa okunikezwa yi-recursive resolver. Ngakho-ke, kunconywa ukuthi ukuxhumana phakathi kwabaxazululi namakhasimende asebenzisa i-DNSSEC kwenzeke ngeziteshi eziphephile.

Naphezu kwale mikhawulo, i-DNSSEC isalokhu iyingxenye ebalulekile yokuqinisa ubuqiniso nobuqotho be-DNS. Kodwa-ke, ukuze kuqhutshekwe phambili futhi kuqinisekiswe ubumfihlo bemibuzo, kubalulekile ukuyihlanganisa nezinye ubuchwepheshe noma ukuguqukela ezixazululweni ezithuthukisiwe.

I-E-DNSSEC: Ku-DNS eqinisekisiwe futhi ebethelwe

Ukuze kuxazululwe igebe lobumfihlo elishiywe yi-DNSSEC, kuphakanyiswe umqondo we -E-DNSSEC (DNSSEC encrypted) . Umqondo walolu hlelo ukwengeza ukubethela emibuzweni ye-DNSSEC ukuze, ngaphezu kokuqinisekiswa nokusayinwa, ivikeleke ekuhlolweni yiqembu lesithathu ngenkathi ihamba nge-inthanethi noma ngenethiwekhi yendawo.

Umgomo we-E-DNSSEC ukuhlanganisa izakhiwo ze-DNSSEC (ubuqiniso nobuqotho) nezindlela zokubethela ezihlinzeka ngemfihlo yemibuzo phakathi kweklayenti le-DNSSEC kanye neseva ye-DNSSEC . Lokhu kwandisa ukuphepha okuphelele kwesevisi ye-DNSEC, okuvimbela ababukeli bangaphandle ukuthi babone ukuthi yimaphi amagama esizinda axazululwayo.

Inqubo yomqondo izofaka ukuhlaziya umbuzo kuseva ephindaphindayo, ukuwubethela ngaphambi kokuwuthumela kuseva enegunya, bese uwususa futhi uwucubungule ngendlela evamile usebenzisa i-DNSSEC . Impendulo, nayo, ingabuyiselwa isayiniwe futhi ibethelwe emuva kuseva ephindaphindayo noma kuklayenti, kugcinwa imfihlo kuyo yonke inqubo.

Le nhlanganisela izoqinisekisa ukuthi umlayezo we-DNS uvikelekile kusukela ekuqaleni kuze kube sekupheleni kwenqubo yokuxazulula: kuqinisekiswe futhi kuqinisekiswe ngenxa ye-DNSSEC, futhi kuvikelwe emehlweni okubuka ngenxa yokubethela okwengeziwe. Esimweni senethiwekhi yendawo noma yebhizinisi, indlela enjalo ingahlanganiswa nezinye izixazululo zokuphepha ze-perimeter.

Namuhla, iziphakamiso ezifana ne-E-DNSSEC ziyingxenye yomzamo obanzi wokuqinisa ubumfihlo be-DNS , kanye nobuchwepheshe obufana ne-DNS phezu kwe-TLS (DoT) kanye ne-DNS phezu kwe-HTTPS (DoH). Isiqondiso esiyisisekelo sicacile: i-DNS yesikhathi esizayo kumele ibe yiqiniso futhi iyimfihlo, futhi akwanele ukuxazulula amagama ngokushesha; kumele futhi kwenziwe ngokuphephile.

Esimweni lapho kunokuhlaselwa kwe-cyber okuyinkimbinkimbi ngokwengeziwe, ukuzenzisa, kanye nezinsongo eziqondiswe ezingqalasizinda eziyisisekelo, ukuba ne-DNSSEC kakade kuyisidingo esibalulekile sokuphepha kunoma yisiphi isizinda esingathi sína, futhi ukuqhubekela phambili ezixazululweni ezibethelwe njenge-E-DNSSEC noma ezifanayo kuvela njengesinyathelo esilandelayo esinengqondo sokuqinisa ukuvikelwa kwamanethiwekhi, kufaka phakathi amanethiwekhi endawo.

Lonke lolu hlelo lokusebenza—kusukela ku-DNS yakudala kuya ku-DNSSEC kanye nezixazululo ezibethelwe njenge-E-DNSSEC—lubonisa ukuthi ukuphepha kwe-DNS akuyona into eyengeziwe ongayikhetha, kodwa kuyingxenye eyinhloko yokwakhiwa kwe-inthanethi nanoma iyiphi inethiwekhi yendawo yanamuhla. Ukuba nezixazululi eziqinisekisa, izindawo ezisayiniwe, izintambo zokwethembana ezigcinwe kahle, kanye, esikhathini esizayo, iziteshi ezibethelwe zemibuzo, kwenza umehluko omkhulu phakathi kwenethiwekhi eveziwe kanye nengqalasizinda elungiselelwe izinselele zamanje nezesikhathi esizayo.

I-athikili ehlobene:

Indlela yokuvula i-DNS nge-HTTPS (DoH) ku-Windows 11 nokuthuthukisa ubumfihlo bakho