Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Seminar "Akamai DNS: Providing Authoritative Answers to the World’s Queries"

Seminar "Akamai DNS: Providing Authoritative Answers to the World’s Queries"

Presentation of the paper "Akamai DNS: Providing Authoritative Answers to the World’s Queries", presented at the Networking seminar at DCC/UFMG 2021/01.

Presentation (PT-BR): https://www.youtube.com/watch?v=1e5gTxnr-m8
Original paper: https://www.akamai.com/it/it/multimedia/documents/technical-publication/akamai-dns-providing-authoritative-answers-to-the-worlds-queries.pdf

E645626cb6d26e2dcdea5a419ae83f3d?s=128

Lucas Bleme

July 12, 2021
Tweet

Transcript

  1. Akamai DNS: Providing Authoritative Answers to the World’s Queries Lucas

    Andrey Bleme DCC/UFMG
  2. Authors Kyle Schomp, Onkar Bhardwaj, Eymen Kurdoglu, Mashooq Muhaimen and

    Ramesh K. Sitaraman SIGCOMM '20 - Annual conference of the ACM Special Interest Group on Data Communication on the applications, technologies, architectures, and protocols for computer communication
  3. Agenda Problem (motivation) Architecture Anycast Resiliency Attack Resiliency Related Works

    Final Evaluation
  4. Problem: Akamai DNS Recursive resolver DNS Root nameserver DNS TLD

    nameserver Authoritative Nameserver mywebsite.com
  5. Problem: Akamai DNS

  6. • High Available network (24/7) • Resilient authoritative DNS •

    Scalable DNS queries: serving 15-20% of all web traffic • Reconfigurable network Erik Nygren, Ramesh K Sitaraman, and Jennifer Sun. 2010. The Akamai Network: A Platform for High-Performance Internet Applications. ACM SIGOPS Operating Systems Review 44, 3 (2010), 2–19. Problem: Akamai DNS
  7. Overall architecture PoP

  8. Anycast prefixes (A B C D E F G …)

    from different PoPs PoP A E F B C G F B A D C E D A B G F A
  9. ex1.com delegated to A B C D E F PoP

    A E F B C G F B A D C E D A B G F A
  10. ex1.com can be still resolved by F PoP A E

    F B C G F B A D C E D A B G F A
  11. Akamai DNS architecture

  12. Single PoP architecture

  13. • Failover withdrawing and advertising anycast prefixes Anycast resiliency

  14. • Failover time < 1 sec. for 76% of measurements

    Anycast resiliency
  15. • BGP update causes 200 msec difference between 2/21 PoPs.

    Anycast resiliency
  16. • Traffic shift for single machine failures withdrawing anycast •

    Monitoring agents with limited server suspension permissions to prevent broad outages Anycast resiliency
  17. • Uses input-delayed nameservers to prevent input-induced failures • Answer

    DNS queries with intentionally stale data ensuring that Akamai DNS remains available • Higher Multi-Exit Discriminator (MED) values prevent input-delayed NS to respond stale data Anycast resiliency
  18. • No PoP supports more than 2 anycast cloud •

    Query scoring and prioritized processing • Overprovision bandwidth to avoid saturated links during volumetric attacks Attack resiliency
  19. Attack resiliency

  20. • Random subdomain attacks prevented using NXDOMAIN filters Attack resiliency

  21. Related Work Matt Calder, Ashley Flavel, Ethan Katz-Bassett, Ratul Mahajan

    and Jitendra Padhye. Analyzing the Performance of an Anycast CDN. IMC '15: Proceedings of the 2015 Internet Measurement Conference. Sebastian Castro, Duane Wessels, Marina Fomenkov, and Kimberly Claffy. A Day at the Root of the Internet, ACM SIGCOMM Computer Communication Review 38, 5 (2008), 41–46. Erik Nygren, Ramesh K Sitaraman, and Jennifer Sun. 2010. The Akamai Network: A Platform for High-Performance Internet Applications. ACM SIGOPS Operating Systems Review 44, 3 (2010), 2–19.
  22. Final Evaluation Guiding design principles through experiments lead to a

    robust authoritative DNS system. Avoiding single points of failure, using automated mitigation strategies and continuing to operate in a degraded state instead of stopping operating at all are the key design principles that allowed such a resilient and high available DNS system.
  23. Thank you. Questions? andreybleme1@gmail.com https://speakerdeck.com/andreybleme