DNSSec is one of those abbreviations that insiders understand, but which all too easily causes confusion and concern for others. However, it is a subject that all those involved in domain management and Internet operations need to understand.
The protocol was born of the need to keep Internet navigation safe for the transmission and communication of sensitive and critical data. For example, an airline using data received via the Internet to maintain its aircraft needs to be sure that the data is appropriate for the aircraft, has not been modified in transit and comes from an authoritatitve source such as an authorized employee of the manufacturer or OEM. DNSSec can be part of the solution helping to ensure the integrity of the internet navigation.
The need for this level of security predates the new security apparatus introduced after 9/11 – but, while the physical security of airports and aircraft has been strengthened worldwide, data security has remained all too susceptible to attack through malice or opportunism.
Bridging the gap between secure and insecure
Fortunately, this issue is being addressed from a number of directions, at strategic and policy, as well as practical, levels.
For example, the US and UK Governments have been instrumental in setting up the Transatlantic Secure Collaboration Program (TSCP) – an initiative "to provide guidelines of policies, procedures, and mechanisms for the secure sharing of sensitive electronic information among international defense companies and their governments, to meet the requirements for increasing collaboration and through life contractor logistic support in an increasingly regulated environment".
In describing its outputs the organization states that, "TSCP is an evolutionary approach to enable people to access data about things to make good decisions in an international secure collaborative environment. It is focused on establishing uniqueness in people, data and things, and auditable metrics for ensuring the data quality that underpins good decisions. Its initial focus was on collaborative security mechanisms and is now beginning to move up the stack into information management with the emphasis expanding from people, through data towards things".
TSCP's activities are driven at the commercial level through major defence contractors - such as BAE Systems, Boeing, EADS/Airbus, General Dynamics, Lockheed Martin and Rolls-Royce - and at Government level by the US Department of Defense, the UK Ministry of Defence and the Canadian department of Public Works and Government Services.
The principle tool for TSCP is a public key infrastructure (PKI), which requires a 'bridge' that acts as a guarantee of quality between all certification authorities issuing digital certificates in the aerospace and defence sectors. SITA is instrumental in providing that bridge through Certipath, a joint venture created with Exostar and ARINC.
The use of PKI has been mandated by the US Department of Defense for all contracts after June 2006. Inevitably the work undertaken by TSCP and Certipath will become adopted by the air transport sector as a whole, particularly as aircraft and airports increasingly become dynamically 'connected'. It follows that every ground system, network and communication link must be adequately secured.
In a presentation to the Air Transport Association e-Business Forum last October, Julien Holstein, the Director of Information Security at Airbus SAS, noted that every facet of airline operation will ultimately be impacted by digital security. At a human level, this includes pilots and cabin crew - but also suppliers and even cleaners. All aspects of flight operations, ground operations and maintenance will be affected. It follows that security policies must be understood and implemented by the community, with new standards and tools.
Scepticism but also first adopters
While PKI provides a powerful level of protection, DNSSec will provide additional levels of security when navigating the Internet.
To understand the importance of DNSSec, imagine what would happen if someone switched all road signs or tampered with your car navigation system while you were driving on holiday in a foreign country. You might end up driving into Paris thinking you were in Rome.
DNSSec is designed to help users avoid this happening when navigating the Internet highway. Armed with DNSSec, the holder of a domain can digitally sign the navigation data to be used by other computers to find the domain and the user, armed with DNSSec aware software and a public key, can verify that the navigation information his computer received is complete and authentic.
DNSSec still faces a level of scepticism and resistance from those most closely involved in its eventual implementation, not least because it carries a cost. However, speakers at the ICANN DNSSec Workshop in Vancouver last December envisaged adoption by e-commerce sites and software developers as more likely to accelerate its adoption than the logical route – adoption by registrars.
One speaker, Uma Murali from the Indian ISP Good Luck Domain, echoed comments from others in suggesting that a more concerted approach to promote the adoption of DNSSec should be adopted by ICANN, governments and ISPs. And many wanted to see its name changed.
"Give it a name, call it the ‘anti-pharming system’, then you have the attention of the business folks," said Ram Mohan, CTO of Afilias (.aero's new registry operator, see next story). "The answer is not return on investment, but return on risk," said Mohan. "How much risk are you willing to take, how much risk do you want to mitigate?".
A number of TLD operators, including Afilias, are conducting advanced trials of the technology. However, credit for the first implementation of DNSSec to a TLD went to NIC.se &ndash operators of the .se country level domain. Announcing their move in September last year, they freely admitted that the service was of no value unless domain holders' name servers also introduced the service. But they equally hope that their initiative as an early adopter "will make it easier for name server operators to offer DNSSec to their customers".
An important issue for air transport
As with any technology development that is concerned with security and housekeeping, rather than overt commercial benefit, the greatest difficulty is in getting the ball rolling. However, there is no doubt that the landscape is changing and that DNSSec is closer to adoption now than it was even four months ago.
Our own view is that the adoption of DNSSec (with or without a catchier name) is important for the air transport community. This is not only because of the greater incidence of pharming and phishing, nor of the wider security implications of increased data transfer within air transport operations. Looking ahead, DNSSec also provides a basis to build trust on the Internet to support high level protocols facilitating IP telephony and Web services. And with our strong interest in the opportunities provided by use of the DNS, we would welcome the widespread adoption of a protocol that provides security and offers greater scope for innovation.
Ready to register a .aero domain? Apply for your Membership ID now.
