1. bookVolume 2019 (2019): Issue 2 (April 2019)
Journal Details
License
Format
Journal
First Published
16 Apr 2015
Publication timeframe
4 times per year
Languages
English
access type Open Access

Oblivious DNS: Practical Privacy for DNS Queries

Published Online: 04 May 2019
Page range: 228 - 244
Received: 31 Aug 2018
Accepted: 16 Dec 2018
Journal Details
License
Format
Journal
First Published
16 Apr 2015
Publication timeframe
4 times per year
Languages
English

Virtually every Internet communication typically involves a Domain Name System (DNS) lookup for the destination server that the client wants to communicate with. Operators of DNS recursive resolvers—the machines that receive a client’s query for a domain name and resolve it to a corresponding IP address—can learn significant information about client activity. Past work, for example, indicates that DNS queries reveal information ranging from web browsing activity to the types of devices that a user has in their home. Recognizing the privacy vulnerabilities associated with DNS queries, various third parties have created alternate DNS services that obscure a user’s DNS queries from his or her Internet service provider. Yet, these systems merely transfer trust to a different third party. We argue that no single party ought to be able to associate DNS queries with a client IP address that issues those queries. To this end, we present Oblivious DNS (ODNS), which introduces an additional layer of obfuscation between clients and their queries. To do so, ODNS uses its own authoritative namespace; the authoritative servers for the ODNS namespace act as recursive resolvers for the DNS queries that they receive, but they never see the IP addresses for the clients that initiated these queries. We present an initial deployment of ODNS; our experiments show that ODNS introduces minimal performance overhead, both for individual queries and for web page loads. We design ODNS to be compatible with existing DNS protocols and infrastructure, and we are actively working on an open standard with the IETF.

Keywords

[1] Allman, M. Case Connection Zone DNS Transactions, 2011–2017. http://www.icir.org/mallman/data.html.Search in Google Scholar

[2] Andersen, D. G., Balakrishnan, H., Feamster, N., Koponen, T., Moon, D., and Shenker, S. Accountable internet protocol (AIP). SIGCOMM Comput. Commun. Rev. 38, 4 (Aug. 2008), 339–350.Search in Google Scholar

[3] Appelbaum, J., and Muffett, A. The “.onion” special-use domain name. RFC 7686, October 2015.Search in Google Scholar

[4] Arends, R., Austein, R., Larson, M., Massey, D., and Rose, S. DNS security introduction and requirements. RFC 4033, March 2005. http://www.rfc-editor.org/rfc/rfc4033.txt.Search in Google Scholar

[5] Bernstein, D. J. Curve25519: New Diffie-Hellman speed records. In Public Key Cryptography - PKC 2006 (Berlin, Heidelberg, 2006).Search in Google Scholar

[6] Bernstein, D. J. DNSCurve: Usable security for DNS. https://dnscurve.org, 2009.Search in Google Scholar

[7] Bortzmeyer, S. DNS query name minimisation to improve privacy. RFC 7816, March 2016.Search in Google Scholar

[8] Calder, M., Flavel, A., Katz-Bassett, E., Mahajan, R., and Padhye, J. Analyzing the performance of an any-cast cdn. In Proceedings of the 2015 Internet Measurement Conference (Tokyo, Japan, 2015), IMC ’15.Search in Google Scholar

[9] Castillo-Perez, S., and Garcia-Alfaro, J. Evaluation of two privacy-preserving protocols for the DNS. In Information Technology: New Generations, 2009. ITNG’09. Sixth International Conference on (2009).Search in Google Scholar

[10] Contavalli, C., van der Gaast, W., Lawrence, D., and Kumari, W. Client subnet in DNS queries. RFC 7871, May 2016.Search in Google Scholar

[11] Cox, J. The people who risk jail to maintain the Tor network. https://motherboard.vice.com/en_us/article/5394ax/the-operators, Apr 2015.Search in Google Scholar

[12] Dagon, D., Antonakakis, M., Vixie, P., Jinmei, T., and Lee, W. Increased DNS forgery resistance through 0x20-bit encoding: Security via leet queries. In Proceedings of the 15th ACM Conference on Computer and Communications Security (Alexandria, Virginia, USA, 2008), CCS ’08.Search in Google Scholar

[13] Damas, J., Graff, M., and Vixie, P. Extension mechanisms for dns (edns(0)). STD 75, April 2013.Search in Google Scholar

[14] de Oliveira Schmidt, R., Heidemann, J., and Kuipers, J. H. Anycast latency: How many sites are enough? In Passive and Active Measurement (Sydney, Australia, 2017).Search in Google Scholar

[15] Denis, F., and Fu, Y. DNSCrypt. https://dnscrypt.info/, 2015.Search in Google Scholar

[16] Dingledine, R., Mathewson, N., and Syverson, P. Tor: The second-generation onion router. Tech. rep., Naval Research Lab Washington DC, 2004.Search in Google Scholar

[17] Federrath, H., Fuchs, K.-P., Herrmann, D., and Piosecny, C. Privacy-preserving DNS: analysis of broadcast, range queries and mix-based protection methods. In European Symposium on Research in Computer Security (2011).Search in Google Scholar

[18] Gieben, M. DNS library in go. https://github.com/miekg/dns, 2018.Search in Google Scholar

[19] Greschbach, B., Pulls, T., Roberts, L. M., Winter, P., and Feamster, N. The effect of DNS on tor’s anonymity. CoRR abs/1609.08187 (2016).Search in Google Scholar

[20] Herrmann, D., Fuchs, K.-P., Lindemann, J., and Federrath, H. EncDNS: A lightweight privacy-preserving name resolution service. In European Symposium on Research in Computer Security (Wroclaw, Poland, 2014).Search in Google Scholar

[21] Herzberg, A., and Shulman, H. Retrofitting security into network protocols: The case of DNSSEC. IEEE Internet Computing 18, 1 (Jan 2014), 66–71.Search in Google Scholar

[22] Hesselman, C., Moura, G. C., de Oliveira Schmidt, R., and Toet, C. Increasing DNS security and stability through a control plane for top-level domain operators. IEEE Communications Magazine 55, 1 (2017), 197–203.Search in Google Scholar

[23] Hoffman, P., and McManus, P. DNS queries over HTTPS (DOH). Internet-draft, May 2018. http://www.ietf.org/internet-drafts/draft-ietf-doh-dns-overhttps-08.txt.Search in Google Scholar

[24] Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., and Hoffman, P. Specification for DNS over transport layer security (TLS). RFC 7858, May 2016.Search in Google Scholar

[25] IEEE standard specifications for public-key cryptography -amendment 1: additional techniques. IEEE Std 1363a-2004 (Amendment to IEEE Std 1363-2000) (Sept 2004).Search in Google Scholar

[26] Jalalzai, M., Shahid, W., and Iqbal, M. DNS security challenges and best practices to deploy secure DNS with digital signatures. In Applied Sciences and Technology (IBCAST), 2015 12th International Bhurban Conference on (2015).Search in Google Scholar

[27] Jung, J., Sit, E., Balakrishnan, H., and Morris, R. DNS performance and the effectiveness of caching. IEEE/ACM Transactions on Networking 10, 5 (Oct 2002), 589–603.Search in Google Scholar

[28] Krishnan, S., and Monrose, F. DNS prefetching and its privacy implications: when good things go bad. In Proceedings of the 3rd USENIX conference on Large-scale exploits and emergent threats: botnets, spyware, worms, and more (2010), USENIX Association, pp. 10–10.Search in Google Scholar

[29] Marchal, S., François, J., Wagner, C., State, R., Dulaunoy, A., Engel, T., and Festor, O. DNSSM: A large scale passive DNS security monitoring framework. In 2012 IEEE Network Operations and Management Symposium (April 2012), pp. 988–993.Search in Google Scholar

[30] Mazières, D., Kaminsky, M., Kaashoek, M. F., and Witchel, E. Separating key management from file system security. In Proceedings of the Seventeenth ACM Symposium on Operating Systems Principles (Charleston, South Carolina, USA, 1999), SOSP ’99.Search in Google Scholar

[31] Mockapetris, P. Domain names - concepts and facilities. STD 13, November 1987. http://www.rfc-editor.org/rfc/rfc1034.txt.Search in Google Scholar

[32] Mockapetris, P. Domain names - implementation and specification. STD 13, November 1987. http://www.rfceditor.org/rfc/rfc1035.txt.Search in Google Scholar

[33] Nobori, D., and Shinjo, Y. VPN gate: A volunteerorganized public VPN relay system with blocking resistance for bypassing government censorship firewalls. In Proceedings of the 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI 14) (Seattle, WA, 2014), pp. 229–241.Search in Google Scholar

[34] Osterweil, E., Massey, D., and Zhang, L. Deploying and monitoring DNS security (DNSSEC). In Computer Security Applications Conference, 2009. ACSAC’09. Annual (2009), pp. 429–438.Search in Google Scholar

[35] Pang, J., Akella, A., Shaikh, A., Krishnamurthy, B., and Seshan, S. On the responsiveness of dns-based network control. In Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement (Taormina, Sicily, Italy, 2004), IMC ’04.Search in Google Scholar

[36] Quad9. https://quad9.net/, 2017.Search in Google Scholar

[37] Reddy, T., Wing, D., and Patil, P. DNS over datagram transport layer security (DTLS). RFC 8094, February 2017.Search in Google Scholar

[38] Shulman, H. Pretty bad privacy: Pitfalls of DNS encryption. In Proceedings of the 13th Workshop on Privacy in the Electronic Society (2014), ACM, pp. 191–200.Search in Google Scholar

[39] Sundaresan, S., Feamster, N., Teixeira, R., and Magharei, N. Measuring and mitigating web performance bottlenecks in broadband access networks. In Proceedings of the 2013 Conference on Internet Measurement Conference (Barcelona, Spain, 2013), IMC ’13.Search in Google Scholar

[40] Thomas, M., and Mohaisen, A. Measuring the leakage of onion at the root: A measurement of tor’s. onion pseudo-TLD in the global domain name system. In Proceedings of the 13th Workshop on Privacy in the Electronic Society (2014), ACM, pp. 173–180.Search in Google Scholar

[41] What is 1.1.1.1? https://www.cloudflare.com/learning/dns/what-is-1.1.1.1/, 2018.Search in Google Scholar

[42] Winter, P., and Lindskog, S. How the great firewall of China is blocking Tor. In Presented as part of the 2nd USENIX Workshop on Free and Open Communications on the Internet (Bellevue, WA, 2012), USENIX.Search in Google Scholar

[43] Zhu, L., Hu, Z., Heidemann, J., Wessels, D., Mankin, A., and Somaiya, N. Connection-oriented DNS to improve privacy and security. In Security and Privacy (SP), 2015 IEEE Symposium on (2015), IEEE, pp. 171–186.Search in Google Scholar

Recommended articles from Trend MD

Plan your remote conference with Sciendo