Mr. Shijixing, chairman of the Board & CEO,aged 58, senior engineer, graduated from Beijing Posts and Telecommunications University in 1967. Mr. Shi is the vice chairman of the Board of Eastern Communications Group Co., Ltd., the deputy President. Mr. Shi was the head of the product research department and the director of the new product institute of HCCL. He was the head of the factory in 1988. Mr. Shi has won many awards, including the 1994 PRC National Excellent Enterpreneur (Golden Ball Award) and the Labour Model of Zhe Jiang Provience. He is recognized as an expert with outstanding contribution to the state and is entitled to a special subsidy from the state.

Ms. Wang Lihua, vice chairwoman of the board,aged 51, senior engineer, graduated from Zhe Jiang University in 1976. She is now the vice chairwoman and the deputy President of Eastern Communications Group Co., Ltd., She was the head of the organization department of HCCL.

Ms. Zeng Yu, director of the board,aged 56, senior accountant, is the President of the finance department of China PTIC Information Industry Corporation. Ms Zeng has held various positions with PTIC including assistant accountants, accountant and a deputy manager in business and finance department.

Mr. Wang Zhongxiong, director of the board & CFO,aged 47, senior economist. he received a university education. Mr. Wang held various positions at HCCL, including secretary to the factory director, head of the finance department and deputy chief accountant.

Mr. Zhang Zexi, aged 45, senior engineer, graduated from college, is the deputy President of Eastern Communications Co., Ltd. He was the head of production department, sales department of HCEF.

Ms. Ni Shouping, director of the board ,aged 36, graduated from college, certified accountant, senior accountant. Ms Ni is the general accountant of Eastern communications Group Co., Ltd. She was the assistant manager of finance department of HCCL and the manager of finance department of Eastern Communications Co., Ltd.

Mr. Pan Yunhe, independent director of the board ,aged 54, graduated from shanghai Tongji University majored in architecture in 1970 and graduated from Zhe Jiang University with Master Degree, majored in computer. Mr. Pan is a computer specialist and academician. He is the president of Zhe Jiang University and graduate school. Since 1990, he has been the director of research institute, dean of computer department and vice president of Zhe Jiang University.

Mr. Gu Jun, independent director of the board ,aged 44, is the chief scientist of China Electrical Information Industry Group Corporation. Mr. Gu graduated from China Science and Technology University majored in electronic engineering in 1982. He got the PhD of computer from Utah University in 1989. He is now the computer professor of Hong Kong Science and Technology University and China Science and Technology University.

Mr. Lu Guanqiu, independent director of the board ,aged 55, senior economist, is the chairman of Zhe Jiang entrepreneur association and Chairman of the Board of Wanxiang Group. The group was established in 1969 and total assets amounted to RMB 5 billion. He was awarded the title of excellent entrepreneur and model worker.

Mr. Shen Yuyin, aged 32, engineer, graduated from Shanghai Tongji University, is the deputy President & secretary to the Board of Directors. He served as an assistant to the director of a branch.

Mr.Hao Xiaofeng, aged 50,master degree,senior engineer,is the deputy President.Mr. Hao held various at HCEF,including head of the information office,head of the technology import office,President of th MCIG division and Trading Division and President of th MCSG Division.

Mr.Chen Xuhong, aged 57, senior engineer, is the deputy President.Mr.Chen has a Bachelor of Science from TsingHua University. He held various positions at HCEF, including head of New Products Research Institute, deputy chief engineer,chief engineer and President of the MCSG Division.Mr. Chen was awarded the title of Expert with Outstanding Contribution to the state,which award entitles him to receive a special subsidy from the State.

Mr.Yu Xudong,aged 46,senior engineer,is the deputy President.He received a university education.Mr. Yu was the deputy director of the Switching Branch of HCEF,President of SPC division,standing vice president of the Great Dragon Telecommunications Equipment Co.,Ltd., president of the Marketing Group of Eastern Communications Group Co.,Ltd.

Mr. Guo Junfeng, aged 31, engineer, graduated from Shanghai Science and technology University with bachelor degree in 1990 and graduated from Zhe Jiang University with MBA in 1998. He is the deputy President & the President of Terminal Communications Products Sales and Marketing Group. He served as assistant manager of R&D Center and the deputy President of Subscriber Division.

Eastcom new TLD registry system is regionally divided into 4 parts: Eastcom Building, Eastcom City, Eastcom Peking, Eastcom USA. Please refer to the network topological graph. Most network facilities are provided by Cisco.

Eastcom Building (Building Introduction): As a standard computer room, it is 2000 square meters by area, equipped with high-power constant temperature and constant humidity air-condition, UPS and lightning proof system, etc. Up till now, it has been connected to the ChinaNet, ChinaGBNet via fiber and plans to be connected to ChinaUniNet and ChinaNetCom as well. Its intra backbone network adopts fiber Gigabit Ethernet technology, and principal database servers are directly connected to backbone switch through fiber interface. In order to ensure the system security, Checkpoint FireWall I and hardware firewall are installed on the Gateway Server. At the same time, ISS network monitor software is applied to monitor and control the flux on the net.

Eastcom City: It has the similar equipment to the system of Eastcom Building. The switches in the above two sites are connected by fiber, 35 kilometers by long. As another part of the TLD Registry System, it takes charge of user authentication, the registry, system development, data backup, etc. By configuration of IP address of registrar and client application, the registry balance between Eastcom Building and Eastcom City could be fulfilled.

Eastcom Peking: Gigabit Ethernet technology adopted on intranet backbone, principal database server connected with backbone switch through fiber NIC, FireWall I installed between intranet and internet, this site takes charge of WHOIS query, client service, database backup, etc.

Eastcom USA: Fiber Fast Ethernet technology adopted on Inner backbone, principal database server configured with 100M NIC, FireWall I installed between inner net and Internet, this site takes charge of data backup.

Function and interactive: All the servers from the above sites are equipped with the complete business procedures, however, they could open different process according to separate functions. Under normal conditions, the registry workload is kept balance by Eastcom Building and Eastcom City. Whichever site falls into problem, the other site will automatically take over all the registry business. If trouble falls on both, Eastcom Peking will take over the registry within 24 hours. Only when the above three networks fail, Eastcom USA turns on the whole business. The WHOIS query is mainly in charged by Eastcom Peking. Eastcom Building and Eastcom City share the business in a balanced way. If the disaster occur, only when the above three networks fail, Eastcom USA gets down to start all registry business.

Details see Annex D_7.

We think that database subsystem is a critical part of the TLD Registry System. Especially after the deployment of DNSSEC, the amount of disk space and RAM consumed by signature and privacy-key information will be more than 10 times of the amount the registry information itself. To satisfy the requirement of capacity, high throughput and scalability, we will adopt the DBMS with highest performance: IBM UDB Enterprise Extended Edition 7.1. DB2 Universal Database supports the following key capabilities and benefits:

Superior scalability - DB2 Universal database can run on everything from laptops supporting mobile users to massively parallel systems with terabytes of data and/or thousands of users. It is the only database in the industry capable of scaling this breadth of systems with the same function. This allows you to minimize costs and maximize personnel skills by using a single database for all your application needs no matter what the scale. You can also rest assured that your applications will not fail because your database ran out of gas.

Multimedia extensibility - DB2 Universal Database allows you to extend the capabilities of the database to meet your specific organizational requirements. This includes the ability to support more advanced applications involving multimedia data such as documents, images, audio and video. You can now develop applications that use technology to gain competitive advantage in ways not previously possible or practical - and you can save costs by just extending DB2 to support these new applications.

Complete web-enablement - One of the key new application areas is e-business. DB2 Universal Database is fully integrated with web technology so that data can be easily accessed from the Internet or from your intranet with complete security. This allows you to quickly build e-business or Internet applications that will provide competitive advantage, greater customer service or reduced costs.

Universe of partner solutions - DB2 Universal Database is capable of supporting a broad range of data management applications with excellent performance and reliability. As a result, a large number of industry solution providers, including SAP, Baan, Peoplesoft, Seibel and thousands more, have adopted DB2 to support their applications; or adapted their tools to support DB2. This allows you to more quickly satisfy your requirements by buying rather than developing solutions.

Business intelligence powerhouse - DB2 Universal Database has particular strengths in supporting business intelligence applications such as data warehousing and on-line analytical processing (OLAP). DB2 leads the industry in parallel database technology and query optimization resulting in the proven ability to help customers find competitive advantage, better customer service or reduced costs by mining their data for the knowledge required to make better decisions. Further, this does not require the additional expense of a specialized database. DB2 UDB provides a single database that can be used across an enterprise for all data management requirements from OLAP to OLTP.

Ease of use and management - DB2 Universal Database is one of the easiest databases in the industry to set up, use and manage. It includes a complete suite of GUI administration tools that allow for easy installation, administration and remote operations. It includes programmer-friendly tools to get an application up-and-running quickly, and user-friendly tools to make end-users immediately productive. Everything you need comes in the box, ready to go.

Universal access - DB2 Universal Database can be accessed from almost any client workstation over almost any network. Through built-in data replication and distributed transactions, it provides you with the flexibility of placing data anywhere in your network required for optimum service and productivity. Further, DB2 provides the most efficient and seamless integration of data on mainframe and midrange data servers in the industry allowing you to reduce costs and improve cycle-times by leveraging your current investments in data, hardware, software, and skills.

Multi-platform support - DB2 Universal Database is one of the most open database platforms available. It runs on the most popular UNIX and Intel server platforms including AIX, HP-UX, Solaris, Linux, NUMA-Q, OS/2 and Windows NT/2000. It supports all major industry standards relevant to distributed data so that it can be accessed using thousands of existing tools and applications, and can be easily managed within an open, network computing environment. These capabilities allow you to reduce costs and improve cycle-times by leveraging your current investments in data, hardware, software, and skills.

Bullet-proof reliability - DB2 Universal Database is setting the standard for quality and reliability in the client/server database industry. As more mission-critical applications are implemented on UNIX and Intel platforms, IBM's ability to bring mainframe-level reliability to this environment has become a major factor in choosing DB2. Better reliability and availability can reduce your costs, while scalability both within and across platforms can reduce the risk of dead-end projects.

Market leadership - IBM entered the client/server database market late. However, with it's core competency in database technology and it's renewed emphasis on software marketing, IBM has delivered more high-quality database technology to market faster than anyone else in the industry. DB2 Universal Database is the culmination of this effort. With DB2 Universal Database, you can rest assured that you are getting the best database technology available today from a vendor with a bright future and the best record of service and support in the industry.

Since registry data organization is hierarchical and the update frequency is much more frequent than the query one, the DNS will be better implemented by using the LDAP technology. So the DNS service will be constructed on the base of LDAP service. And the security of the DNS data can be ensured by the LDAP Server. The DNS acts as the client of LDAP. At the same time, the DNS acts as a CORBA object. Then the DNS data can be asynchronously updated with the help of the Notify Service defined in CORBA. The asynchronous data updating is better than the synchronous one, which will make the Root Server update its data at any free time during processing the normal service and avoid the occurrence of the congestion. The amount can be set when data are updated each time. Many a small updates can be combined to form an asynchronous update so that the network traffic cost of updates will be minimized. If the continuous peek time caused by normal service surpass the interval could be tolerated between two data updates, it shows that the computing capacity of the DNS Server need to be upgraded. The use of Cluster computing makes the upgrade easer and cheap. The reporting capacity could be provided by the OLAP module of the UDB EEE.

An ERP system will be adopted as billing and collection systems, Products of SAP, Oracle, IFS are under consideration.

Backup procedure: In the database system, there stores two copies of registry data, which locates in different databases. Before the backup, it is required to stop the synchronization between the backup data file and online database first, then to proceed the database backup applying the control in ARC Server IT. Then, after completing the backup, to synchronize the backup data file and online database until the next backup. Each set of backup data will have two copies, one in the computer room and the other sent to the third party for saving. At the beginning of each week, we designate a certain responsible person to deliver last week’s incremental backup and this week’s full backup to the third party.

Backup strategy: Since the TTL in the database of currently used name server is 6 days, we could constitute backup strategy once a week. Each week, to full backup the data in database, then to incrementally backup the data every 12 hours. As a complementarity, we copy the full backup on CD-ROM and also send it to the organization of data security for saving.

Hardware and system: We apply tapes for daily backup, using ARC Server IT backup software of CA company for data backup. Since the amount of data is particularly large and special server and backup facility are adopted to proceed data backup and recovery, we make use of compressed-tape data format for backup. Thus we could reduce the frequency of tape-replacing without influencing the speed of data backup and recovery. In case of information leakage due to losing medium, we encrypt the data in the tape.

The Eastcom‘s new TLD registry system security is fulfilled by hardware firewall, software firewall product (Checkpoint FireWall I) and network security monitor software (ISS).

Registrar authentication: certificate (issued by the third party) authentication bases on client IP address; system administrator decides what resources and programs the user is allowed to access, when he can access and how many sessions can be set up, and etc.

Data Transfer Encryption: The four sites of our system are connected to Internet, so the data transferred should be encrypted. We use the FWZ encryption method (encryption and privacy key management method provided by FireWall I) and DES encryption algorithm. These methods encrypt different packets with distinct keys and make the packets’ size unchanged at the same time.

Content Security: FireWall I provides content security monitor API for the HTTP, SMTP and other protocols by its secure sever. Integrated with OPSEC Alliance API, the system can protect the content security from virus, malice JAVA and ActiveX. At the same time, it will provide the optimized Internet service.

The key equipments used in our system, such as routers, switches, are protected by the access control list based on port, ensuring that only the workstations of some network addresses can access them so that attacking these equipments is prevented.

Most of the network equipments we use are produced by Cisco. We can deploy Intelligent secure network with the Cisco product. Cisco is a point-to-point secure solution provider. The secure products of Cisco include :

To face the possible DNA (Distributed Network Attacks) in the future, we will develop our own resistance method to prevent DNA and cripple the attack. The following measures will be taken:

1. Using network and host scanning tools to detect vulnerability: The key point of the success of DNA (such as DDoS) is the availability of a great deal of immune deficiency systems on the Internet. Thus using security tools to check the network and host regularly and to take correspondent measures will eliminate the unseen trouble of the current system. This will lower the possibility of being attacked by the hacker. Security scan tools will detect and clean up the software on the host installed by hackers, just like anti-virus tools.
2. Filter the network flux in and out: Network service provider should take measures to filter the network flux aiming at preventing any fake IP packet from entering the network., which will diminish the source of some DNAs, such as DDoS and weaken its effects. This would be achieved by the cooperation among all ISPs. If not, it will have no distinct effects.
3. Using Network Intruder Detection System(NIDS) and Sniffer: When the system receiving the questionable packets, the NIDS send warning message to system administrator, and remind him to take correspondent measures, such as breaking the connection, reverse tracing. Normally, the security policy of NIDS is the newest, including the characteristic description of the latest attacking technology. Only this kind of NIDS can detect the latest attacking behavior, such as Tr in00, TFN and Stacheldraht. Sniffer can distinguish the attacking behavior at the network level and forward this information to NIDS. Sniffer can recognize some behaviors such as tampering the data inside the IP packet. This kind of information can be used to trap the hacker.

To run the system smoothly, the following measures will be taken:

1. Supply enough hosts to deal with the attack: If Eastcom deploys enough capacity and resource, the hacker will deplete his resource first when attacking EastCom
2. Utilizing network equipment fully to protect network resource: The routers and firewalls can be used efficiently to protect the system.
3. Filtering the redundant service and port and any fake-IP using the Inexpress, Express Forwarding: The Cisco Express Forwarding compares the packets source IP and Routing Table and filter questionable packets.
4. Checking the source of visitor by Unicast Reverse Path Forwarding: With this technology the system can check whether the visitor’s IP is fake, which will enhance the system security.
5. Filter all the IP address defined in RFC1918: Some IP addresses defined by RFC1918 are reserved for particular purpose.
6. Limit the SYN/ICMP flow: When SYN/ICMP flow surpasses the limitation, it indicates that maybe there is an intruder.

Engineering Support: Eastcom agrees to provide Registrar with reasonable engineering telephone support (between 9 a.m. and 5 p.m. Peking time or at such other times as may be mutually agreed upon) to address engineering issues arising in connection with Registrar's use of the System.