What is the Snowman Project? Can shut down the Internet with one click? Here is the truth about the Snowman Project

What is the Snowman Project? What is the truth about Snowman Project? Is it true that the United States can shut down the Chinese Internet at any time with one click? When the United States sanctioned ZTE some time ago, discussions about domestic chips and operating systems were heated up. Now the matter has basically settled. Many institutions and individuals have realized the shortcomings of our country in this regard, and are currently trying their best. Catch up.

The matter is over, but since then, doubts about the Chinese Internet have come and gone. Some fierce remarks even think that the "new four great inventions" are just a mirror image. Among them, the most lethal of these is "the United States can paralyze the Chinese Internet with one click" and so on. The shocking words make people panic. The key is that there are still some experts and scholars who stand for this platform.

It must be emphasized and clarified that whoever controls the network domain name and network address controls the physical foundation, application and development of the network space, and thus controls the data source, information assets and open source intelligence of network communication, and has hidden Change or explicitly manipulate the dominant ability and voice of cyberspace boundaries.

This view first unearthed the "ultimate meaning" of the Internet today, that is, the root server. What does the root server do? We visit websites, such as Baidu. This is actually a domain name, which corresponds to an IP address such as 61.135.169.125, and most of us don’t know the specific address of the website. We need to resolve the domain name we visit. This resolution is equivalent to translation, and the root server is responsible for translation, pointing the domain name to the IP and then returning it to the computer requesting access.

The root server stores the resolution of many domains such as .com. Although the root server does not have specific information about each domain name, in theory, every domain name browser must convert the domain name into a request for the corresponding IP address, and finally go through the root server Guide, visit the server where the domain name is located. That is, every time we visit a website, the information must travel around the United States. (Now there is technology that does not need to detour to the United States, because some cache servers already have backups of relevant domain name guidelines.)

Although the virtual network is virtual, its establishment has its actual material basis, that is, one server after another, and your data exchange stops when the server is up. For example, if the WeChat server goes down, you will not be able to send messages to your WeChat friends, because the online communication will ultimately depend on offline machines.

There are only 13 root servers in the world (the names of the 13 root domain name servers are "A" to "M"), and one is the main root server in the United States. The remaining 12 are all auxiliary root servers, 9 of which are in the United States, 2 in Europe, respectively in the UK and Sweden, and 1 in Asia in Japan.

Does it feel a bit cool to see here? There is no one in China. In this contrast, it is not difficult to understand why there are such remarks. As the lifeblood of the Internet, but this lifeblood is in the hands of others, this feels really uncomfortable.

However, we say that in 30 years of Hedong and 30 years of Hexi, the earth has been spinning non-stop for a moment, time has changed, and the status of the root server above has been a matter of the IPv4 era.

In 2013, my country seized the historical opportunity of upgrading from IPv4 to IPv6 and launched the "Snowman Project", proposing a complete set of root server solutions and technology systems based on IPv6, facing emerging applications, and independently controllable.

The "Snowman Project" was initiated by the China Next Generation Internet Engineering Center and jointly established with WIDE (now the Internet M-root operator) and the Internet Domain Name Engineering Center (ZDNS). Before the end of June 2015, 25 root server operation volunteers will be recruited from all over the world to jointly test and verify IPv6 root server operation, domain name system security extension key signatures and key rotation. "The'Snowman Project' is appropriate and feasible." There is still a lot of work to be done to truly realize the multilateral governance of the global Internet. By uniting global organizations to do testing and trial operations, and clearing technical obstacles, not only can we win more supporters, but also promote the corresponding standardization progress within the IETF (Internet Engineering Task Force).

The "Snowman Project" is actually an IPv6 test plan developed by ICANN (The Internet Corporation for Assigned Names and Numbers) in June 2015. Domestic reports claim that "China's Next Generation Internet National Engineering Center took the lead in the "Snowman Project"", which is inconsistent with the facts announced by ICANN. ICANN is a non-governmental organization established in the United States in accordance with the laws of the United States.

The global next-generation Internet (IPv6) root server test and operation experimental project based on a new technology architecture-"Snowman Project" was officially released on June 23, 2015.

The "Snowman Project" completed the installation of 25 IPv6 root servers (total 3 primary roots) in 16 countries around the world including the United States, Japan, India, Russia, Germany, and France in 2016, of which 1 primary root and 3 secondary roots were deployed in China , To break the dilemma that China did not have a root server in the past.

China has never had its own IPv4 root server before. These servers are in the hands of the United States. An American can have six IP addresses, while in China, 26 people share one IP address.

Just mentioned that the total length of IPv4 addresses is 32 bits, which means there are only 4.29 billion addresses at most. With the rapid increase in the number of Internet users and more and more devices connected to the Internet, IPv4 has exhausted the entire number of addresses. The length of IPv6 has reached 128 bits, adding a total of 340 trillion IP addresses. Even if everyone on the planet has dozens of networked devices, the allocation is more than enough.

This has laid a solid foundation for the Internet of Everything in the future 5G era. What will our network look like by then? Wait and see!

According to public information on the "Snowman DNS Project" website, the "Snowman" DNS system is a real-time test platform for the root domain name server system:

● This is a usable test platform, but anyone who uses this test platform should be informed that this is a test platform for root domain name service and some experiments.

● The project will end at the end of 2018 (may be extended for a period of time to complete the experiment, but will not be extended).

● This test will not add/delete delegation records (DelegaTIons) in the IANA root zone. It just changes the delegation information of the root DNS server and identifies all RRsets with the "YeTI" DNSSEC key.

● No alternative domain name space is provided.

3. Dr. Paul Vixie, one of the initiators of the "Snowman Project" and an inductee of the Internet Hall of Fame (Internet Hall of Fame), published an article on March 30, 2016 to clarify:

1. From a technical point of view, the service of any DNS root domain does not come from any set of DNS root domain name servers, but from an "alternate root directory". However, not all alternate root domains are equal. I think that for the global Internet, the alternative root domain name of "Name Space Fork" is a bad idea. The fierce competition between Internet domain name spaces is detrimental to all of us-including business, freedom of speech, national and personal security.

2. Therefore, technically speaking, the "Snowman Project" not only has the potential to introduce "alternative roots", it is actually an alternate root domain name. However, this is not a domain name space fork, nor can it be like this. The alternative root domain name service is the "third track" of Internet governance: if you touch it, you will die.

3. Nevertheless, the experiment of root domain name server technology on a global scale is still an effective subject of network science. Therefore, the three coordinators of the "Snowman Project" (BII, Tiandi Internet; WIDE, Japan; Paul Vixie, the United States) all issued strong public statements against the "forking" of the domain name space (sometimes called "domain name Space expansion", or more simply called "domain name space piracy"). The operators of the "Snowman Project" root name server all know this, and the experimenters and enthusiasts who intend to choose the "Snowman" root name server to handle root domain name queries also need to know this. If any one of us changes this position, the entire project will be overthrown.

4. So, does this mean that as stated in the White Paper of the World Economic Forum, the "Snowman Project" can "introduce an alternative root domain name source"? It depends on what we call "substitution." If we mean the expansion of the domain name space, people other than IANA can effectively edit the top-level domain name space, such as adding a new top-level domain name (TLD) or changing the ownership of an existing top-level domain name (TLD), the answer is definitely no.

5. In my opinion, what is even more dangerous is that the "Snowman Project" provides a precise road map that enables people other than IANA to establish an alternative root domain name. In this sense, the "Snowman Project" may actually lead to the introduction of alternative roots for the pirated domain name space. In large enterprises, there is a legitimate and universal demand for this alternate root domain name service, but the documents and tools that support this service do not exist, especially in the DNSSEC environment.

6. Please note: I personally contact the operators of the BRICS countries (Brazil, Russia, India, China, South Africa) to ensure that they understand the "Snowman" project and can participate in it. My point is that if a country decides to distrust ICANN one day, and they want to create their own Internet DNS system, I hope they have the necessary expertise and capabilities, as well as the awareness of weighing national sovereignty. I would suggest such a country, such independence would be unhealthy, vulgar and short-lived. But I will not claim that they must listen to me.

Fourth, my country does not have the actual management rights of the root server and its mirrors, and there are obvious management and control risks. The root domain name service is at the top of the entire domain name service system, and its service performance directly affects the overall quality of the domain name service.

According to the 2016 China Internet Information Center CNNIC data, of the 633 root mirrors deployed globally, only 9 are located in mainland China (including 8 in Beijing and 1 in Hangzhou).

According to the interpretation of the Asia-Pacific Information Center (APNIC), the Internet currently has only 13 root domain names. Due to the early system design and IPv4 constraints, the general application of DNS is limited to 512-byte UDP protocol transmission, and IPv4 addresses require 32 words. Section, 13 root domain names need to occupy 416 bytes, so there are only 96 bytes for the transmission of DNS protocol information. Since IPv6 has no address space constraints, new root domain names may be added in the future.

What needs to be clear is that the IP addresses of the current 13 root domain names are set by default in application software, such as operating systems, browsers, and domain name servers. Obviously, adding a new IPv6 root domain name (new IP address) is not easy to achieve overnight.

5. Xinhua News Agency reported that the “Snowman Project” has completed the installation of 25 IPv6 (Internet Protocol Version 6) root servers worldwide, and China has deployed 4 of them. the fact is:

25 "domain roots" (IPv6 top-level domains or Internet secondary domain servers) are drawn from the M root (Asia-Pacific root) of the US Internet in Japan, of which one so-called primary root and four so-called secondary root servers are connected to China. Since the so-called primary root (actually a second-level domain name server) and 25 secondary roots (actually a third-level domain name server) of the "Snowman Project" resolve addresses leased to the United States, it is necessary to pass the M root in Japan and v6 in the United States. It is updated and broadcasted with other European roots, so there must be a hierarchical problem. It cannot be said to be the root, but only the top-level domain!

The above structure clearly shows that the so-called primary root of IPv6 in China is actually the parent root server, primary root server, and secondary root domain name server of the Internet absolutely controlled by the United States. The 25 root domain name servers introduced are only in the parent root and M root of the Internet. The IPv6 top-level domain under control is the Internet secondary domain server. All domain name address allocation and resolution routing must still be achieved and completed through the exchange of the US Internet parent root, main root and M root. In addition, IPv6 domain names and IPv6 addresses are rented from the United States, and the usage fees (costs such as rent) paid by operators will inevitably be passed on to users.

6. The four so-called domain root servers leading to China's IPv6 system are also not in China. The two offices’ notice required: “Promote the introduction of root mirroring servers to further improve the resolution performance of the domain name system. Carry out technological innovation of the new root domain name service system structure and application, build a certain scale of experimental verification network facilities, and carry out application demonstrations.” This also It clearly shows that China currently does not have an IPv6 root server and needs to "promote the introduction of root mirror servers."

According to recent domestic media reports, Wu Hequan, an academician of the Chinese Academy of Engineering, said that it is not clear whether and how many IPv6 main roots can eventually be built in China. Wu Hequan pointed out: "The IPv4 root server still has the right to interpret the IPv6 root server, so even if China has an IPv6 root server in the future, it does not mean that China can play a leading role."

From this point of view, if someone is not deliberately lying or exaggerating to create public opinion that "IPv6 roots are built" and "roots are in China," someone has seriously misunderstood the truth of ICANN's IPv6 test system and misleads public opinion.

7. What deserves special attention is that my country has been preventing Japan from intercepting our country's intelligence for a long time, and has taken many important preventive measures in network routing management and control. The IPv6 root server of the so-called "Snowman Project" in China is derived from the M-root set in Japan by the United States, resulting in an irreversible routing pattern in which my country’s IPv6 network information must be exchanged through Japan and then to the United States. Japan will be able to obtain massive amounts of first-hand more easily. The consequences of Chinese intelligence are disastrous!

What's more noteworthy is that, according to comprehensive data, the US government system currently has 4 dedicated root domain name servers (all currently support IPv6), and the US military currently has 6 dedicated root domain name servers (currently none of them support IPv6). These dedicated root domain name servers are logically separated from the 13 public (commercial) root domain name servers. That is, to access the U.S. government or military network from the public network, the public root domain name server is still required, while the government and military network systems use the private root The domain name server cuts into the public network. It can be determined that the US government and military's IPv6 systems (including specifications and testing) can be relatively independent of commercial use, which not only differentiates the application from the source, but also has a clear monitoring boundary. U.S. government affairs network has also established a new domain name Fed.us, which is only for internal use by government departments. Before the large-scale deployment of IPv6 in China, the United States completed the isolation (monitoring boundary) of its government and military networks from public (commercial) networks. Is it to actively prevent and control potential threats from China's IPv6 system? Or is it to maintain the commanding heights and initiative advantages that restrict China's IPv6 system? Or a combination of both?

8. Sovereignty is the top priority for cyberspace security, and it is the principle and prerequisite for building a community with a shared future in cyberspace. Network domain names and network addresses are important strategic resources and symbols of national sovereignty in cyberspace.

Through the Snowman Project, China will therefore obtain the right to manage root servers and has deployed 25 root servers globally. People in the industry at home and abroad talked a lot. Will the US easily hand over the root server to China? The answer is: no; will China replace the United States as the world overlord of IPv6? The answer remains: No!