Contents Introduction Requirement of Internationalized Domain Name Internationalized Domain Name General Requirement IDNS Technology Encoding 에의한접근 Pr

Size: px

Start display at page:

Download "Contents Introduction Requirement of Internationalized Domain Name Internationalized Domain Name General Requirement IDNS Technology Encoding 에의한접근 Pr"

윤혜 마
6 years ago
Views:

1 다국어및한글지원도메인 네임시스템 Konkuk Univ. Kee-chon Kim mailto : kckim@konkuk.ac.kr Homepage :

2 Contents Introduction Requirement of Internationalized Domain Name Internationalized Domain Name General Requirement IDNS Technology Encoding 에의한접근 Protocol 에의한접근 IDNS Solutions Conclusion 2

3 Introduction 현재의인터넷 빠른속도 서비스의다양화 무선서비스, 인터넷가전, 전자상거래, 세대를초월한인터넷사용자층의빠른저변확대 인터넷도메인네임에서다국어요구 Internet Domain Name Alphabet 56(a-z, A-Z), number 10(0-9), hyphen(-), dot(.) [RFC1035] 3

4 Requirement of Internationalized Domain Name

5 Internationalized DNS Internationalized Domain Name A sequence of characters that can be used in the context of functions where a hostname is used today, but contains one or more characters that are outside the set of characters specified as legal characters for host name. [RFC1123] 5

6 Internationalized DNS IDN representation examples 건국대. 대학. 한국 건국대. 대학. 한국 kckim@ 건국대. 대학.kr telnet 건국대. 대학. 한국 ftp 건국대. 대학. 한국 6

7 Multilayer model Multilayer model of the DNS function application resolver Application service interface For, ex> gethostbyxxx interface (base data) Auth DNS server DNS service interface Forwarding DNS server Caching DNS serverr Parent-zone DNS servers Root DNS server 7

8 Service model Service model of the DNS Hostname-to-address(A, AAAA, A6) Hostname-to-Mail server service(mx) Address-to-hostname service(ptr) Domain delegation service(ns) So on New service being defined IPv6 to hostname mapping DNSSEC 8

9 General Requirement Proposed the total 30 requirements Compatibility and interoperability 현재 DNS 와호환성을지원 서로다른 Protocol 과의상호연동성지원 Internationalization DNS 이름과레코드에여러글자계 (Script) 의글자를지원 다양한입력방식지원 건국. 대학. 한국, kckim@ 건국. 대학.kr 9

10 General Requirement Canonicalization Matching rules Case folding Ligature Operational issue Zone file : easily editable Others DNSSEC, DNAME 10

11 IDNS Technology

12 IDNS Technology Encoding 방식에의한접근 Unicode Transformation Format ASCII Compatible Encoding Protocol 구조에의한접근 IN-bit IDNRA IDNA New Class : UC 12

13 Encoding 방식에의한접근 Unicode UTF : Unicode Transformation Format UTF-5, UTF-8, UTF-6 ACE : ASCII Compatible Encoding RACE, BRACE, SACE DUDE AMC-ACE-M LACE 13

14 Unicode Transformation Format UTF-5 초창기 IDNS 에서적용 Unicode 를 5bit 로인코딩 기존 ascii 역시변환이되므로호환이없음 UTF-8 [RFC 2279] Unicode 를 8bit 로인코딩 ASCII 문자는인코딩후에도그대로유지됨으로호환성을제공 IDNS 서버및 resolver 는 8bit 문자를인식할수있도록수정되어야함 UTF-6 UTF-5 의개량버젼 Unicode 를 6bit 로인코딩 14

15 ASCII Compatible Encoding 7bit 체계, ASCII 와완전호환성을지원 종류 ACE(ASCII Compatible Encoding) RACE(Row-based ASCII Compatible Encoding) Two transform passes, Base32 Encoding Difficult to verify results DUIDE(Differential Unicode Domain Encoding) One transform pass, encodes with UTF-5 Still some objection to unclearness in draft AMC-ACE-M One transform pass, encodes with UTF-5 More complex than DUDE Compresses better for widely-mixed scripts LACE(Length-based ASCII Compatible Encoding) Two Transform passes, Base32 encoding 15

16 Protocol 구조에의한접근 IN-bit flag IDNRA IDNA New Class : UC 16

17 IN-bit flag DNS 패킷의헤더부분중, 향후사용을위해남겨진 IN-bit 를 IDN 플래그로사용 IN-bit = 1 : IDN, UTF-8 Encoding IN-bit = 0 : ASCII DNS 가 IN-bit 를인식하도록수정되어야함 IN-bit 는 DNS packet 의마지막여분 bit IN-bit 사용시기존 DNS packet 의추가적인확장불가 17

18 Internationalized Host Names Using Resolvers and Applications (IDNRA) The interfaces in IDNRA User Input and display: any charset Application API call and return: UTF-8 Only user applications and the resolvers on user's systems be updated. No changes are needed to the DNS protocol or any DNS servers. Resolver DNS query and response: RACE DNS servers 18

19 Internationalized Host Names Using Resolvers and Applications (IDNRA) (con t) New application, new resolver All host names MUST be resolved using new API A user MAY enter a name that uses RACE encoding. When the resolver receives a RACE name, if the query was to the new API, the resolver MUST convert the host name part to the binary form. Root Server Considerations Because there are no changes to the DNS protocols, adopting this protocol has no effect on the root servers 19

20 Internationalizing Host Names In Applications(IDNA) Interfaces between DNS components in IDNA User Input and display: local interface methods (pen, keyboard, glowing phosphorus, ) Application End system Resolver API call and return: nameprepped Ace DNS servers DNS query and response: nameprepped ACE 20

21 Internationalizing Host Names In Applications(IDNA) (con t) Users and applications 사용자와어플리케이션의인터페이스는변경되지않음 Applications and resolvers 특정 API 를제공하지않음 입력된호스트네임을어플리케이션에서 ACE 포맷으로인코딩하여리졸버에게전송함 Resolvers and DNS servers DNS 는 IDN 을반드시 ACE 포맷으로저장하고있어야함 Avoiding exposing users to the raw ACE encoding This is not considered a big problem because so few applications show this type of resolution to users 21

22 Internationalizing the DNS A New Class New class? Class name : UC(Universal characters) 기존 IN Class 와같은형태의 RR 정의 Ex> 건국대 UC A6 0::FFFF: IN Class 와차이 Label, 모든필드는 UTF-8 로정의된 8bit 텍스트에기반 UC Class 를위한 new RR 사용 ( 기존 RR + New RR) Class UC 에 delegation 을위한 NS RR 사용 22

23 Technical alternatives, the deployment, transition nightmare A new class proposal Would obviously not be easy to deploy Cleanly separate international character set name spaces from the ASCII one old clients and systems would never see the non-ascii types Possible transition model Would be to conclude that the new Class was intended, over time, to simply obsolete and replace Class=IN 23

24 Technical alternatives, the deployment, transition nightmare(con t) Preparation and comparison of names ASCII name Has the advantages of containing a very small set of characters and permitting an extremely easy case-mapping algorithm Requiring no composed characters Raising no significant issues with canonicalization or identitymatching Multilingual name Beyond the requirements of ASCII about a set of character comparison issue intrude a query matches in tables for a domain strict rules be applied to how names are stored and how queries are presented interpret a somewhat-ambiguous query 24

25 Technical alternatives, the deployment, transition nightmare(con t) Registration in both places Whether to register the multilingual name exclusively (Dual registration) Multilingual name in class=uc ASCII-based name in class=in Whether ASCII-based names as well Register both multilingual name and ascii-based name in class=uc Search rules and search failures 한 DNS 서버에서의 Class=UC, Class=IN 사이의네임서칭 Class=UC 서버와 Class=IN 서버사이의네임서칭 Cross-class NS RR : Delegation 지원문제 25

26 Technical alternatives, the deployment, transition nightmare(con t) New class solution versus an edns/utf-8 one edns/utf-8 Use non-ascii DNS label Use class=in, utf-8 Updated client and primary server 는 interoperability 를지원하지않음 New class Use utf-8, Class=UC Interoperability 는 issue 가아님 26

27 Technical alternatives, the deployment, transition nightmare(con t) New class approach versus an ACE one ACE approach Ascii-compatible Labeling mechanism 이요구 (prefixes, suffixes) New class 같은 system 에서 ascii, ascii-compatible, utf-8, another endcoding type 을 class=uc 로사용가능 Encoding type 을결정하기위한 labeling mechanism(prefixes, suffixes) 이필요없음 27

28 Technical alternatives, the deployment, transition nightmare(con t) A four-stage conversion process at legacy applications Completely legacy (non-updated) code would continue to reference class=in (ii) Application code would be upgraded to make Qclass=UC, and to represent the UCS codes for their database The protocols would be upgraded to international norms and usage The applications code would be changed to conform to the new protocols, eliminating the workaround of stage(ii) 28

29 Other issue Bringing RR type 예 ) AAAA -> A6 Kakameymi.example UC A6 0::FFFF: Root server management So on 29

30 IDNS Solutions 국내 ngdns (UTF-8), mbind (IN-bit, UTF-8) 국외 mdnkit ( 일본 ) UTF-8, UTF-5, UTF-6, RACE, BRACE, LACE, DUDE idns ( 싱가포르 ) RACE, UTF-8, UTF-5 30

31 Conclusion idns 필요성증대 다양한서비스에서요구 해결해야될문제 표준화문제가시급 인코딩방식의표준화 프로토콜에대한표준화 응용프로그램의다국어수용 31

제20회_해킹방지워크샵_(이재석)

제20회_해킹방지워크샵_(이재석) IoT DDoS DNS (jaeseog@sherpain.net) (www.sherpain.net) DDoS DNS DDoS / DDoS(Distributed DoS)? B Asia Broadband B Bots connect to a C&C to create an overlay network (botnet) C&C Provider JP Corp. Bye Bye!