DNS/DANE Collision-Based Distributed and Dynamic Authentication for Microservices in IoT ^†

Area of Science:

• Computer Science
• Network Security
• Distributed Systems

Background:

• Internet of Things (IoT) devices generate vast data, straining network infrastructure.
• IoT security is challenged by outdated software and the need for secure, dynamic microservice deployment in fog computing.
• Existing DNS-based Authentication of Named Entities (DANE) and DNS Security Extensions (DNSSEC) struggle with the dynamic nature of IoT microservices.

Purpose of the Study:

• To address the scalability and security challenges of dynamic IoT microservice instantiation in fog computing environments.
• To propose a modified DNSSEC/DANE signature mechanism suitable for short-lived, frequently changing microservices.
• To enhance the flexibility and efficiency of secure service discovery for nomadic IoT users.

Main Methods:

• Introduction of chameleon signatures, which allow re-signing data without re-computation using a secret trapdoor.
• Definition of a new soft delegation scheme enabling DNS servers to modify constrained zones without impacting primary servers.
• Integration of chameleon signatures and soft delegation to manage dynamic DNS updates for IoT microservices.

Main Results:

• The proposed solution significantly improves the efficiency of handling frequent DNS updates caused by dynamic microservice instantiation.
• Chameleon signatures and soft delegation overcome the limitations of traditional DNSSEC/DANE in static environments.
• Secure and efficient discovery of dynamic IoT microservices in fog networks is achieved.

Conclusions:

• The combination of chameleon signatures and soft delegation offers a scalable and secure method for managing dynamic IoT microservices in fog computing.
• This approach enhances the flexibility required for ubiquitous computing, particularly for nomadic users.
• The findings pave the way for more robust and adaptable IoT security architectures.