Design of DNS based Zero Trust enhanced authentication system
Zou Ligang1, Zhang Yifan1, Zhang Xinyue2,Yuan Jianting3
1. Beijing Guoke Cloud Computing Technology Co., Ltd.; 2. China Internet Network Information Center; 3. School of Information Science and Engineering,Xinjiang University,Unumqi
Abstract： The article addresses the security risks associated with the widespread reuse of certificates in current HTTPS applications. Drawing on the idea of dynamic authorization of security policies in the Zero Trust model, it proposes a solution that enhances authentication capabilities by leveraging the existing Internet infrastructure, specifically DNS. This solution involves dynamically authenticating HTTPS access requests by adding enhanced authentication information to existing DNS authoritative servers. By doing so, it enables real-time validation of the security status of current HTTPS certificates. This approach effectively tackles the security issues arising from the common practice of certificate reuse in HTTPS, utilizing the trusted and readily available DNS infrastructure. It represents a flexible, efficient, and scalable Zero Trust security enhancement authentication framework.
Key words : HTTPS; certificate; Zero Trust Security Model; DNS; DNS-CA
