- Category: July 2011
The first of three facilities that will bring an extra measure of security for internet users around the globe was inaugurated in Singapore last month.
Packet Clearing House (PCH) and the Internet Corporation for Assigned Names and Numbers (ICANN) joined the Infocomm Development Authority of Singapore, saying the new facility will provide secure digital signatures for country-code top level domains of dozens of countries.
The three new facilities, located in Singapore; Zurich, Switzerland (still under construction) and San Jose, California, provide cryptographic security using the recently deployed Domain Name System Security (DNSSEC) protocol. Internet users in each country that adopts the new service will be assured of the authenticity of the websites they visit and the email addresses they use.
Since its standardization by the Internet Engineering Task Force (IETF), the DNSSEC protocol has been adopted by many top-level domains (TLDs) to form a secure chain of trust within the internet's domain name system.
This year, several major TLDs, including .de, the German country-code top-level domain, as well as .com and .net have already secured their own domains by generating cryptographic keys which are used in the DNSSEC system to electronically “sign” the domains, authenticating them to internet users who access the web sites, email, and other internet resources the signed domains contain.
Although people browsing the internet often take it for granted that the sites they visit are created and operated by their purported owners, it is possible for criminals with knowledge of the internet’s addressing system to create counterfeit websites that look like the real thing but capture users’ private information. DNSSEC guards against this cyber threat.
PCH’s DNSSEC facilities will allow many additional countries to immediately gain the benefits of DNSSEC protection for their country code TLDs without needing to build and maintain their own million-dollar security facilities, so cryptographic master keys were recently created for Tanzania, Uganda, Afghanistan, and ten other countries that have already chosen to use the system.
The new signing facilities are part of a comprehensive drive to adopt the DNSSEC protocol, spearheaded by ICANN with its signing of the root of the domain name system last June, increasing internet security worldwide.
“One of ICANN’s core missions is to enhance the security and stability of the internet’s Domain Name System. This new DNSSEC facility in Singapore helps us do just that,” said Rod Beckstrom, President and Chief Executive Officer of ICANN. “The bottom line is that this center and the two others like it will give billions of internet users the confidence to know that they have ended up at the web site they intended to reach, reducing the risk that they have been misdirected to a different site by cyber criminals.”
“Businesspeople, governments, and regular internet users have been demanding secure domain names for more than ten years, and I’m really happy to have finally built a system that delivers that, and delivers it globally, to any country that wants it, at no cost,” said Packet Clearing House’s Research Director, Bill Woodcock. “DNSSEC was an obvious next step for our global anycast DNS service network, since we already provide service to more than eighty countries.”
Mr. Leong Keng Thai, Deputy Chief-Executive and Director-General of Telecoms & Post, IDA, said, “We are honoured that PCH, with the support of ICANN, has decided to host the Asia node of the DNSSEC platform here in Singapore. The facility will assist other countries to secure their DNS, and its location here further affirms Singapore as a secure and trusted hub."
Director of the National University of Singapore Computer Centre Tommy Hor, said "NUS, which is the birthplace of internet services in Singapore, is proud to be part of the trans-national, multi-agency effort behind this critical cyber infrastructure. By hosting the DNSSEC facility on campus, NUS will contribute our expertise and work closely with our partners in ensuring a better, more trustworthy and productive internet infrastructure for users in Singapore, the region and beyond."
PCH’s DNSSEC service is unique in several ways as it employs the same degree of physical, network, and procedural security as ICANN uses to sign the root of the domain name system, meeting all of the same rigorous standards; all components were selected for low power consumption and the system as a whole will be both carbon and energy-neutral upon completion. It is entirely free of cost for country-code top level domains and its goal is as much knowledge-transfer and regional self-sufficiency as immediate implementation, while all of its procedures and software follow best practices and are published open-source, using a Creative Commons license that ensures that all can benefit from them equally.