Projects

Data centres consume about 2% of the world's electricity, and DNS resolution, the first step of every Internet communication, is part of that footprint. Encryption (DNS over TLS/HTTPS), DNSSEC and the coming move to post-quantum cryptography all add energy overhead, yet the energy cost of DNS has barely been measured. DECODES measures the energy consumption of DNS infrastructure, models the impact of security protocols and of DNS-based amplification attacks, and proposes optimisations that keep DNS secure while reducing its energy footprint.

• FundingANR Generic Call 2025 (PRCE)
• PartnersAfnic (coordinator), ENPC, France-IX, Télécom SudParis

Project website

Aviation authorities increasingly require drones to broadcast a remote identity. The IETF Drone Remote Identification Protocol (DRIP) working group defines identifiers and authentication formats that let anyone nearby verify a drone's identity from its Wi-Fi or Bluetooth broadcasts. This project builds and tests a DNS-based registry for DRIP, so that observers can look up a drone's identifier and retrieve trusted information about the aircraft and its operator, with prototypes developed together with student teams.

• FundingCollaborative project with universities
• PartnersAfnic, Linköping University, Télécom SudParis (student projects)

IETF DRIP working group

ENE5AI designs an open-source, open-hardware edge-networking infrastructure that lets companies adopt 5G, 5G NR-U, device-to-device and Wi-Fi services, especially for Industry 4.0, without depending on the large web platforms. Afnic's contribution is a DNS-over-HTTPS (DoH) resolver adapted to the edge, giving companies sovereignty over the resolution of their domain names and preparing them for HTTP/3.

• FundingFrench call for sovereign telecom-network solutions
• PartnersGreen Communications, Afnic, Gandi, Smile, CESAMES, CityPassenger, LIP6 (Sorbonne Université / CNRS), CNAM and others

IoT devices produce sensor data that is poorly protected: channel encryption is often terminated at gateways, identifiers reveal who is communicating, and the cryptography in low-end devices is weak. PIVOT protects the content objects themselves and uses privacy-friendly names as the main way to access IoT data, so that device identifiers disappear from public metadata. The project worked on a crypto framework for ultra-constrained devices, decentralised object security, minimal trust-anchor provisioning, and multi-stakeholder name management, validated on RIOT and LoRaWAN. The project also funded Ibrahim Ayoub's PhD on privacy-preserving IoT communications based on DNS.

• FundingGerman-French Joint Call on Cybersecurity (ANR / BMBF), ANR-20-CYAL-0002
• PartnersAfnic (French coordinator), Inria, FU Berlin (German coordinator), HAW Hamburg

Project website

IoT networks usually work as separate silos, and a device can roam onto another network only when the operators have signed an agreement in advance. Inspired by eduroam, IoTRoam sets up an open roaming infrastructure for LoRaWAN that needs almost no manual configuration. Networks discover each other dynamically through the DNS (using the iotreg.net LoRaWAN DNS service operated by Afnic), and the back-end servers authenticate each other with a PKI and DANE, so federated certificate authorities and self-signed certificates can be used. The proof of concept, built on open-source software, led to changes in the LoRaWAN Backend Interfaces specification that were accepted by the LoRa Alliance, and around ten universities and companies expressed interest in joining.

• FundingAfnic initiative, linked to the ANR DiNS project
• PartnersAfnic (lead), Télécom SudParis, and academic and industrial members of the LoRa Alliance

IoTRoam tutorial (GitHub)

IoT networks are often isolated silos. DiNS aims to make them interoperable with the Internet by using DNS and its extensions. The project designs a scalable naming and resolution architecture for IoT, secures device identifiers and key distribution with DNSSEC and DANE, explores how device characteristics can be described in DNS to enable rich discovery queries, and proposes a name-resolution scheme for roaming between multi-tenant networks, in a similar way to eduroam.

• FundingANR Generic Call 2019 (PRCE)
• PartnersUniversité Grenoble Alpes / LIG (coordinator), IMT Atlantique, Afnic

Zonemaster is an open-source tool that checks the quality of a domain's DNS delegation and helps operators find and fix configuration errors. It was developed jointly by Afnic and the Swedish Internet Foundation to succeed their earlier tools, ZoneCheck and DNSCheck, with a modular engine, a command-line interface, an API and a web interface. Zonemaster is used by registries and DNS operators worldwide, and the project received the CENTR R&D Award in 2015.

• FundingJoint project of Afnic and the Swedish Internet Foundation
• PartnersAfnic, Internet Foundation in Sweden (IIS)

Project website

The Object Name Service (ONS) is the GS1 lookup service that links product codes (EPC/RFID tags) to information about those products. WINGS proposed a federated architecture for ONS, so that no single root operator controls it, and compared a DNS-based federated ONS with a peer-to-peer (DHT) approach through specifications, test platforms and benchmarks. The results were contributed to GS1 standardisation.

• FundingANR VERSO programme, ANR-09-VERS-015
• PartnersGS1 France, Orange Labs, Afnic

The THD (Très Haut Débit) platform was a cooperative programme to experiment with new online services and content made possible by very-high-speed broadband in the Paris region. It combined a cluster of shared resources (strategic watch, hosting, usage studies) with experimentation panels and industrial pilot projects. Afnic co-led the strategic watch work package.

• FundingCap Digital Paris-Région competitiveness cluster, FUI call n°5
• PartnersCap Digital (coordinator), Afnic, Université Paris 13, MSH Paris Nord, and other academic and industrial partners