In this section, we delve into the examination of security and dependency challenges within the Chinese Government Web Information System. Our focus encompasses a range of critical components including domain name resolution, the utilization of third-party libraries, Certificate Authority (CA) services, Content Delivery Network (CDN) services, Internet Service Providers (ISP), the adoption of HTTPS, IPv6 integration, and DNSSEC implementation. To conduct more thorough analysis, we employ a suite of advanced tools, aiming to provide a comprehensive overview of the existing security posture and interdependencies.
5.1 Domain name resolution
Failures within the DNS can have a dramatic impact on the broader Internet, most notably by blocking access to any services (e.g., web, mobile applications) that rely on the domain name [40].
We found that 2,234 domains have NS records, 4,687 domains have CNAME records, 13,708 domains have A records, and 7,462 domains have AAAA records. Surprisingly, the results show that 26.85% of domain names do not have NS records set. This means that these domain names may not have effective DNS configuration, which may cause them to be inaccessible or unstable on the Internet.
Consider the 4,687 domain names that have CNAME records, which are often used to alias one domain name to another domain name. This means that although these domain names do not have direct A or AAAA records, they can be successfully mapped to the corresponding IP addresses through the resolution of alias names. This approach may be to facilitate the management and maintenance of the domain name system, but it also adds a certain amount of complexity and potential resolution delays. We queried 13,898 unique domain names and found that these domain names were resolved by 563 DNS host names. We measured all 563 DNS servers corresponding to all hostnames. The results showed that these host names involved a total of 894 different DNS servers after resolution, of which 634 were IPv4 servers and 260 were IPv6 servers.
In order to understand the redundancy of these DNS servers, we further calculated the Diversity scores of these DNS servers. From Fig. 3 we found that 64.51% of them had scores between 1.0 and 2.0. 2.0–3.0 accounts for 7.21%. 3.0–4.0 accounts for 16.03%. 4.0–5.0 accounts for 10.63%. 5.0–6.0 accounts for 1.62%. 1.0 represents no redundancy measures. [41] point out that servers must be placed in both topological and geographically dispersed locations on the Internet to minimize the possibility of a single failure disabling all these functions. A good example is using different servers with different ASNs from different operators in different regions.
In Table 1, the Internet Domain Name System Beijing Engineering Research Center LLC is identified as managing China's root (mirror) servers, providing enterprise-level and top-level domain name services. Notably, the China Internet Network Information Center does not directly offer domain name registration services to end users; instead, this service is predominantly provided by other companies in Table 1, which typically include both domain name registration and resolution services, defaulting to the registrar's own domain name servers.
Table 1
Top 10 DNS resolution service providers: (A domain name may have multiple DNS servers).
| Company Name | Domain Count |
| Beijing Guokeyun Computing Technology Co.,Ltd. | 7553 |
| Alibaba Cloud Computing (Beijing) Co.,Ltd. | 5928 |
| Xin Net Technology Corporation | 3170 |
| DNSPod, Inc. | 1631 |
| Internet Domain Name System Beijing Engineering Research Center LLC | 1369 |
| Leascend Technology Co.,Ltd | 823 |
| Guangdong Huyi Science&Technology Co.,Ltd | 488 |
| Bizcn.com,Inc. | 454 |
| China Internet Network Information Center | 423 |
| Chengdu west dimension digital technology Co., LTD | 256 |
| Xiamen Nawang Technology Co., Ltd | 162 |
From Table 1, we observe a notable dependence on the top five service providers for DNS services. This concentration suggests that a significant portion of domain name registration and resolution services is managed by a handful of companies. Such a scenario has both advantages and disadvantages.
On the positive side, relying on major service providers can lead to increased reliability and efficiency. These companies often have the resources to ensure high uptime, robust security measures, and the ability to handle large volumes of traffic. Their experience and expertise in managing DNS services can also contribute to the stability and performance of the internet infrastructure within their service areas.
However, this heavy reliance also introduces potential risks. A lack of diversity among service providers could lead to single points of failure in the network infrastructure. In the event of a technical issue, cyber attack, or regulatory action affecting one of these major providers, a significant portion of the DNS infrastructure could be compromised, impacting accessibility and security across a wide area. Additionally, this concentration could limit competition, potentially leading to higher prices and less innovation in the DNS service market.
Given these considerations, the reliance on the top five service providers for DNS services underscores the importance of adopting strategies to mitigate risks associated with such concentration. These could include encouraging the development and use of alternative DNS providers, implementing regulatory measures to ensure fair competition and service quality, and promoting the adoption of DNSSEC and other security measures to enhance the resilience and integrity of DNS services across different providers.
5.2 Third-party libraries
As shown in Fig. 4, 78.91% of the systems use jQuery. Considering its proportion, we focused on the version distribution of jQuery. The results are shown in Fig. 5.
The analysis reveals that a significant number of the third-party libraries in use, specifically 4,250, are vulnerable, notably due to the CVE-2020-23064 vulnerability affecting jQuery versions 2.2.0 to just before 3.5.0.
In response to this problem, more stringent vulnerability management and security review measures should be adopted to ensure the security and reliability of government websites. This includes regularly updating third-party libraries to the latest versions, monitoring and timely fixing known vulnerabilities, and other measures. However, this management task can be affected by many complex factors, such as incompatibility issues and considerations of other dependencies.
When implementing vulnerability management and security reviews, government agencies need to balance security and system stability. When updating third-party libraries, thorough testing should be performed to ensure that the new version does not introduce new compatibility issues or other surprises. At the same time, third-party libraries that have undergone security reviews and are continuously updated and maintained should be given priority to minimize security risks.
5.3 CA services
In our analysis of 9,011 certificates, we uncovered that 2,011 did not align with any SubjectAltName or SubjectCommonName, hinting at potential lapses in certificate management or setup. A noteworthy finding is that 31.86% of the certificates were issued by entities outside of China, with a significant number originating from North America and Europe, showcasing the global distribution within the digital certificate ecosystem [36].
The effectiveness of different Transport Layer Security (TLS) versions varies markedly, with the adoption rates among Chinese government websites reflecting a dedication to cybersecurity enhancement. TLSv1.3 is utilized by 34.77% of these sites, indicating a substantial shift towards the most current standards, known for their superior security and performance benefits compared to earlier versions. Despite this progress, TLSv1.2 remains prevalent at 65.20%, likely due to legacy system compatibility needs or delayed updates in some areas. The nearly obsolete TLSv1, at just 0.03%, highlights its diminished relevance and susceptibility to recognized threats.
This evolution from TLS 1.0 to TLS 1.3 signifies considerable advancements in securing online communications. TLS 1.0's vulnerabilities are extensively documented, while TLS 1.1, though better, still does not meet current security standards. TLS 1.2 introduced significant enhancements, including stronger encryption algorithms and protocol improvements, providing effective protection against modern cyber threats. However, it's also prone to specific vulnerabilities, such as the Lucky 13 side-channel attack.
TLS 1.3 marks a significant improvement in both speed and security, streamlining the handshake process and removing outdated cryptographic methods. The adoption of TLS 1.3 by 3,133 government websites reflects a proactive approach to implementing the latest security protocols, crucial for protecting sensitive data [42].
The TLS version distribution—minimal use of TLS 1.1, a majority on TLS 1.2 (5,875 sites), and a noteworthy transition to TLS 1.3 (3,133 sites)—demonstrates a strategic upgrade path among government bodies. This trajectory not only emphasizes the importance of information security but also indicates an eagerness to adopt advanced technologies for strengthening digital infrastructure.
The shift towards newer TLS versions among Chinese government websites signals a broad commitment to enhancing cybersecurity. This gradual transition from TLS 1.1 to the more secure TLS 1.2, and eventually to the latest TLS 1.3, reflects a wider intention to embrace state-of-the-art technologies and protocols, ensuring comprehensive security measures against evolving online threats.
From Fig. 6, the landscape of Certificate Authority (CA) certificate issuers is marked by DigiCert Inc.'s prominent position, holding a 26.56% market share. This dominance underscores the trust and reliability placed in DigiCert's services, indicating a high level of confidence from its users. Similarly, the China Financial Certification Center (CFCA) with a 16.96% market share, highlights its significant role within China, likely fulfilling specific regulatory or industry-specific requirements. Beijing Xinchacha Credit Management Co., Ltd.'s 13.42% market share suggests its strategic importance in regional or industry-specific security needs.
The widespread adoption of TLSv1.3 reflects a commitment to cybersecurity, showing a preference for CA certificates that meet high security standards, especially in sensitive sectors. Nonetheless, the continued use of TLSv1.2 poses security risks, necessitating a move towards more secure versions like TLSv1.3 and routine security assessments to protect against vulnerabilities.
Relying heavily on a single CA issuer introduces risks of concentrated attacks or disruptions. Therefore, diversifying CA sources is crucial to reduce dependency and enhance system resilience. It's recommended to conduct regular audits and adhere to security best practices, ensuring the integrity and reliability of the certificate ecosystem.
5.4 CDN services
In the digital landscape of Chinese government web information systems, the adoption of Content Delivery Network (CDN) services plays a pivotal role in enhancing web performance and security.
Table 2
Top10 CDN service providers.
Table 2
Top10 CDN service providers
| Company Name | Count |
| Hangzhou Dbappsecurity Co., Ltd. | 966 |
| Beijing Knownsec Information Technology Co., Ltd. | 794 |
| Qi-Anxin Legendsec Information Technology (Beijing) Inc. | 710 |
| Fujian Wanwu Yilian Network Technology Co., Ltd. | 633 |
| eName Technology Co., Ltd | 407 |
| Wangsu Science&Technology Co.,Ltd. | 300 |
| Changsha Zhiwei Information Technology Co.,Ltd. | 173 |
| Shenzhen Zhi'an Network Co., Ltd. | 140 |
| China Telecom Corporation Limited Network Security Product Operation Center | 131 |
| Yundun Intelligent Security Technology Co., Ltd. | 131 |
The analysis shows that 5994 web information systems, constituting 43.13% of the total, leverage CDN (Content Delivery Network) services, highlighting the critical role of CDN technologies in enhancing efficiency and security for government web resources. The data in Table 2 reveals a notable preference for established CDN providers within the government sector, with the top five companies delivering 58.56% of CDN services to Chinese government websites. This trend underscores the government's prioritization of reliability and performance in web services.
Leading the provision of CDN services are key players such as Hangzhou Dbappsecurity Co., Ltd., Beijing Knownsec Information Technology Co., Ltd., and Qi-Anxin Legendsec Information Technology (Beijing) Inc., among others. Hangzhou Dbappsecurity Co., Ltd. stands out with 966 instances, illustrating the competitive nature and strategic government partnerships with these firms. The geographical distribution of these services, with companies serving specific regions, suggests a strategy to optimize CDN efficiency through local expertise and infrastructure.
This strategic selection of CDN providers reflects a balanced approach to managing digital infrastructure in the government sector, focusing on both performance optimization and stringent cybersecurity measures.
5.5 ISP
In our analysis, we explored the security and redundancy of China's government web information systems through a unified lens, focusing on geographical distribution, ASN diversity, ISP diversity, and domain redundancy. By examining the geographical spread of IP addresses linked to DNS servers, we highlighted the importance of diverse locations for enhanced fault tolerance. The evaluation of Autonomous System Numbers (ASNs) associated with IP addresses revealed that DNS servers drawing from a wide range of ASNs are less vulnerable to issues tied to a singular network provider. Furthermore, analyzing the Internet Service Provider (ISP) information for each IP underscored the value of utilizing multiple ISPs for additional redundancy layers. Additionally, we assessed the redundancy of IP addresses for individual domain names, emphasizing the necessity for domains to associate with multiple IPs for higher resilience.
As depicted in Fig. 7, our analysis introduces a 'server diversity score' that encompasses several critical factors: server count, ASN, geographical distribution, and ISP diversity. The majority of scores fell between 1.00 and 2.00, reflecting a moderate distribution of servers across various geographies, ASNs, and ISPs, without any scores surpassing 2. This pattern highlights a significant potential to improve server redundancy across Chinese government websites. Our findings indicate that the existing levels of diversity and redundancy fall short of what is required for optimal security and reliability.
An important addition to the analysis is that a lower diversity score may suggest that a government website's servers are concentrated under a specific geographic region, ASN, or ISP, increasing the risk of a single point of failure. Improving your diversity score can help improve the stability and reliability of your system, reducing the potential risk of service interruptions due to region-specific or network failures. Therefore, improving the geographical location, ASN and ISP distribution of servers to improve diversity scores, as well as increasing the number of servers, are key steps to improve the overall redundancy capabilities of government websites.
From Fig. 8, it can be found that among the ISPs, China Mobile, China Telecom, China Unicom, and Alibaba Cloud occupy 98.29% of the market.
The threats brought by reliance on a small number of ISPs mainly involve network stability, security and competitive environment. A small number of ISPs means that control of the entire network infrastructure is highly concentrated in the hands of a few providers, which can lead to risks in terms of network availability. If one of the ISPs experiences a failure or attack, the entire network could be affected, causing widespread service outages. The risk of this single point of failure poses a serious threat to the business continuity and communication capabilities of enterprises and individual users.
The monopoly position of a few ISPs may also lead to a deterioration of the competitive environment. The lack of competition means that users have limited space for choice, which can lead to lower service quality and higher prices. ISP monopoly may also lead to the destruction of network neutrality, that is, some content providers may receive better service quality or access speed, while other content providers will be treated unfairly, thus distorting market competition.
Reliance on a few ISPs may pose serious threats to network stability, security, and competitive environment. Governments, regulatory agencies, and industry organizations need to take measures to promote the diversity and competition of network infrastructure to ensure network stability, safe and fair.
5.6 Other applications
(1) HTTPS adoption
In the analysis of 6789 (48.50%) sites that only support HTTP, 483 (3.45%) sites that only support HTTPS, and 6435 (45.97%) sites that support both HTTP and HTTPS, we found that potential security risks mainly exist in Only in sites that support HTTP.This is because HTTP communications are not encrypted and are vulnerable to man-in-the-middle attacks. In comparison, the number of sites that only support HTTPS is relatively low, but because it provides SSL/TLS encrypted communication and can guarantee the confidentiality and integrity of data, it has higher security.
It’s worth noting that the number of sites supporting both HTTP and HTTPS is higher, which is a positive trend. This approach provides users with flexibility of choice; however, for security reasons, ensure that a secure HTTPS connection is used by default.
In our examination, we found 292 sites that were inaccessible for various reasons, requiring further investigation and resolution. These issues can be grouped into three main categories, each representing a different proportion of the total: Client Request Errors (9.9%), Certificate and SSL/TLS Errors (13.0%), and Network Connection Issues (77.1%). This distribution underscores the critical need for a multifaceted approach to enhance management of request parameters and permissions, improve certificate configurations and renewal mechanisms, and optimize network architecture and maintenance practices. Addressing these areas is pivotal for boosting service quality, security, and availability, while also tackling the managerial and technical challenges associated with network security and protocol transitions. It highlights the urgency of adopting a rigorous and scientific methodology to develop systematic and comprehensive solutions.
(2) IPv6 adoption
It is fascinating to examine the data on the adoption of IPv6, as it sheds light on the current state of internet protocols. Based on the information gathered, it is apparent that IPv4 is still the dominant protocol, as evidenced by the fact that 11,114 websites (equivalent to 79.97% of the sample) rely solely on it. This situation is likely due to historical reasons, device compatibility issues, and network configurations. This trend indicates that the adoption of IPv6 is still lagging behind in some network areas.
Only 93 websites use Dual Stack architecture, supporting both IPv4 and IPv6. This approach is positive because it provides users with greater flexibility and compatibility. This may be the leading practice of some advanced institutions or service providers in adapting to IPv6 transition.
The 2,691 (19.36%) websites that only use IPv6 reflect the active adoption of IPv6 by some organizations or service providers. This may be to meet future IPv4 address shortage challenges, or to improve network performance and security.
(3) DNSSEC adoption
Our comprehensive testing of DNS servers revealed that 51 of them are equipped to support DNSSEC (Domain Name System Security Extensions). However, a subsequent examination of domain name information via whois queries disclosed a peculiar inconsistency: all DNSSEC signatures were listed as unsigned. This finding contradicts our observations from querying domain name DNS records using the dig tool, where we discovered RRSIG (Resource Record Signature) records for 101 subdomains.
Despite the apparent lack of signed DNSSEC statuses in the whois database, the presence of RRSIG records for 101 subdomains, as revealed through dig tool queries, typically signifies the implementation of DNSSEC to safeguard the integrity and authenticity of DNS records. This discrepancy suggests that while specific DNS records may have been signed, such signatures might not be accurately represented in the whois database, or alternatively, the signing may be limited to certain subdomains rather than encompassing the entire domain.
5.7 Comprehensive analysis
(1) ZAP analysis
A ZAP analysis of Chinese government websites revealed multiple security issues. Through our research, we found that 10,187 government websites are not configured with the X-Content-Type-Options Header, which may make the websites vulnerable to MIME type spoofing attacks. 10,323 government websites do not set the Content Security Policy (CSP) header, which may increase the risk of cross-site scripting attacks. 8,182 government websites lack Anti-CSRF Tokens, which may make them vulnerable to cross-site request forgery (CSRF) attacks. On the CSP side, 3,203 websites included Wildcard Directives in their policies, 761 used insecure eval, and 3,202 used insecure inline. These problems may lead to potential security vulnerabilities and need to be repaired in time. 8,158 government websites are missing Anti-clickjacking headers, making them more vulnerable to clickjacking attacks. The HttpOnly Flag is not enabled for the cookies of 3,313 websites, and 6,624 cookies lack the SameSite attribute, which may put the cookies at risk of improper access. 1,069 government websites have private IP addresses leaked, which may reveal sensitive information about system architecture.
In summary, government websites need to take a series of measures, including but not limited to configuring security headers, implementing effective CSP, strengthening CSRF protection, restricting cookie access, repairing private IP address leaks, etc., to improve their overall security level.
(2) Lighthouse analysis
When Lighthouse is executed, it evaluates websites across multiple dimensions, including:
-
SEO: It emphasizes the creation of concise, meaningful meta descriptions that accurately summarize page content. It advises ensuring pages are accessible to search engines through appropriate robots.txt configuration and recommends using descriptive text for links and managing anchors that can be crawled to enhance site discovery. The implementation of hreflang tags is suggested for specifying language and regional nuances. Caution is urged with plugin use, as they may impact a page's indexability. Optimizing viewport settings and document titles are also recommended to improve search engine relevancy.
-
Accessibility: The guidance includes adhering to ARIA roles and properties to clarify the purpose of elements, using aria-hidden to control visibility for screen reader compatibility, and ensuring ARIA attributes are valid. It stresses the importance of sufficient color contrast for readability, assigning unique IDs to focusable elements, providing descriptive titles for frames, and alt text for images. It also suggests optimizing click targets for interactive elements and addressing various accessibility issues to enhance the experience for individuals with disabilities.
-
Performance: Strategies involve compressing text-based resources to reduce network load, minimizing interaction delays, optimizing blocking times, and improving paint events like first content paint, largest contentful paint, and speed index. Recommendations include minimizing unused JavaScript, deferring script loading when possible, and leveraging back/forward caching for faster navigation.
-
Progressive Web Apps (PWA): Recommendations focus on optimizing for mobile screens, including viewport settings and content width, reducing input latency, and ensuring content displays correctly across devices.
-
Best Practices: Ensuring websites are served over HTTPS for security, implementing a robust content security policy (CSP) to mitigate cross-site scripting (XSS) risks, managing geolocation and notification prompts to enhance user trust, and avoiding restrictions on input pasting to maintain user experience and security.
For instance, metrics in Fig. 9 such as "uses-http2" and "is-on-https" reflect adherence to best practices, while attributes like "aria–" indicate a site's accessibility level. Metrics like "link-name" can boost a site's SEO score.
Based on the report of Lighthouse, we calculated the correlation between performance, accessibility, best practices, SEO, and PWA. Drawing from Table 3, our correlation coefficient analysis exposes intriguing relationships among website performance and various critical metrics, weaving a detailed narrative of their interconnections. A notable negative correlation emerges between website performance and indicators such as accessibility, best practices, SEO, and PWA, with coefficients ranging from − 0.30 to -0.40. This pattern suggests a prevalent trend where regions with diminished website performance concurrently exhibit deficiencies in these crucial areas.
Table 3
Correlation between performance, accessibility, best_practices, seo and pwa.
| Metrics | performance | accessibility | best_practices | seo | pwa |
| performance | 1 | -0.37 | -0.32 | -0.31 | -0.39 |
| accessibility | -0.37 | 1 | 0.33 | 0.51 | 0.41 |
| best_practices | -0.32 | 0.33 | 1 | 0.62 | 0.57 |
| seo | -0.31 | 0.51 | 0.62 | 1 | 0.81 |
| pwa | -0.39 | 0.41 | 0.57 | 0.81 | 1 |
A strong positive linkage is observed between best practices and both SEO and PWA, with coefficients of 0.62 and 0.57, respectively, signifying that commitment to best practices is a reliable predictor of success in SEO and PWA development.
The most pronounced positive correlation is between SEO and PWA, standing at 0.81, highlighting a significant synergy where SEO improvements are closely aligned with PWA advancements. This intricate web of correlations offers a nuanced perspective on the interplay between performance, accessibility, best practices, SEO, and PWA, providing invaluable insights for web developers and administrators aiming to refine web experiences.