Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers

DUAN Liying; LI Ruixuan; LIU Ximeng; SHAO Jun; LIU Baojun

doi:10.11959/j.issn.2096-109x.2024067

您当前的位置：

首页 >

文章列表页 >

Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers

Topic：Internet DNS Security | 更新时间：2024-12-20

- Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers
- Chinese Journal of Network and Information Security Vol. 10, Issue 5, Pages: 71-80(2024)
- 作者机构：
  
  1.福州大学计算机与大数据学院，福建福州 350108
  2.清华大学网络科学与网络空间研究院，北京 100084
  3.浙江工商大学计算机科学与技术学院，浙江杭州 310018
- 作者简介：
- 基金信息：
  
  The National Key R&D Program for Young Scientists of China(2023YFB3105600)
- DOI：10.11959/j.issn.2096-109x.2024067
  CLC： TP393
- Received：30 May 2024，
  
  Revised：2024-08-22，
  
  Published：25 October 2024
- 稿件说明：
移动端阅览
段丽莹, 李瑞烜, 刘西蒙, 等. 递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析[J]. 网络与信息安全学报, 2024, 10(5): 71-80.

Format: DUAN L Y, LI R X, LIU X M, et al. Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 71-80.
段丽莹, 李瑞烜, 刘西蒙, 等. 递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析[J]. 网络与信息安全学报, 2024, 10(5): 71-80. DOI： 10.11959/j.issn.2096-109x.2024067.

Format: DUAN L Y, LI R X, LIU X M, et al. Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 71-80. DOI： 10.11959/j.issn.2096-109x.2024067.

摘要

加密DNS协议最初被设计用于保护用户和递归解析器之间（用户-递归侧）的DNS通信隐私。目前，加密DNS协议获得了广泛应用。然而，递归解析器和权威服务器之间（递归-权威侧）的DNS通信仍遭受着大量隐私威胁。历经4年的标准化进程，互联网工程任务组在2024年2月正式发布RFC 9539，提出可利用加密DNS协议来保障递归-权威侧的DNS通信隐私。聚焦于在递归-权威侧部署加密DNS协议所带来的隐私收益，提出评估互联网域名隐私收益的方法。针对243万个流行域名和4万个敏感域名，结合1 058个顶级域名的区域文件，分析权威服务器所托管的域名数量，从而判定目标域名的隐私收益等级。测量结果表明，超过90%的域名可获得递归-权威侧部署加密DNS协议的隐私保护，但是6.28%的敏感域名无法从递归-权威侧部署加密DNS协议中获得隐私收益。此外，一些高流行度的域名也没有获得足够的隐私收益。相较于大型域名托管商，小型域名托管商可为域名提供更高的隐私收益。将域名部署于仅托管单个域名的权威服务器上会极大地损害递归-权威侧加密DNS协议的隐私保护效果，管理人员应重新审视域名托管服务。

Abstract

The encrypted DNS protocol was originally designed to protect DNS communication privacy between users and recursive resolvers (user-recursive side). Currently

encrypted DNS communication has been widely deployed. However

DNS communications between recursive resolvers and authoritative servers (recursive-authoritative side) still faced significant privacy threats. To address this issue

the Internet Engineering Task Force (IETF) officially released RFC 9539 in February 2024

which utilized the encrypted DNS protocol to protect DNS communication privacy on the recursive-authoritative side. Focusing on the privacy benefits of deploying the encrypted DNS protocol on the recursive-authoritative side

a method to evaluate the privacy benefits of domain names was proposed. The method defined three levels of privacy benefits by analyzing the number of domain names hosted by authoritative servers of the target domain name. Combined with the zone files of 1058 top-level domains

the privacy benefit level was determined for 2.43 million popular domain names and 40 thousand sensitive domain names. The results showed that over 90% of domain names could achieve privacy protection through the deployment of encrypted DNS on the recursive-authoritative side. However

6.28% of sensitive domain names could not benefit from such deployment. In addition

some popular domain names also did not gain privacy benefits. Compared to large domain hosting providers

smaller providers could offer higher privacy benefits for domain names. Administrators were advised not to deploy domains on authoritative servers that hosted only a single domain name

which significantly compromised the privacy protection effectiveness of encrypted DNS protocol deployment on the recursive-authoritative side.

关键词

Keywords

references

LIU B , LU C , DUAN H , et al . Who is answering my queries: understanding and characterizing interception of the DNS resolution path [C ] // Proceedings of the 2019 Applied Networking Research Workshop (ANRW) . New York : Association for Computing Machinery , 2019 : 15 - 16 .

HU Z , ZHU L , HEIDEMANN J , et al . Specification for DNS over transport layer security (TLS) [R ] . 2016 .

HOFFMAN P , MCMANUS P . DNS queries over HTTPS (DoH) [R ] . 2018 .

HUITEMA C , DICKINSON S , MANKIN A . DNS over dedicated QUIC connections [R ] . 2022 .

BISHOP M . HTTP/3 [R ] . 2022 .

JENSEN T , PASHOV I , MONTENEGRO G . Windows will improve user privacy with DNS over HTTPS [J ] . Retrieved May , 2019 , 15 : 2020 .

LI R , JIA X , ZHANG Z , et al . A longitudinal and comprehensive measurement of dns strict privacy [J ] . IEEE/ACM Transactions on Networking , 2023 , 31 ( 6 ): 2793 - 2808 .

ED T W . DNS privacy considerations [R ] . 2021 .

PETIT-HUGUENIN M , SALGUEIRO G , ROSENBERG J . Session traversal utilities for NAT (STUN) extension for third-party authorization [R ] . 2021 .

STÉPHANE BORTZMEYER . DNS privacy considerations [R ] . 2015 .

LU C Y , LIU B J , LI Z , et al . An end-to-end, large-scale measurement of DNS-over-encryption: how far have we come [C ] // Proceedings of the Internet Measurement Conference . New York : ACM , 2019 : 22 - 35 .

KOSEK M , DOAN T V , GRANDERATH M , et al . One to rule them all? a first look at DNS over QUIC [C ] // Proceedings of the International Conference on Passive and Active Network Measurement . Cham : Springer , 2022 : 537 - 551 .

BÖTTGER T , CUADRADO F , ANTICHI G , et al . An empirical study of the cost of DNS-over-HTTPS [C ] // Proceedings of the Internet Measurement Conference . New York : ACM , 2019 : 15 - 21 .

CHUNG T , VAN RIJSWIJK-DEIJ R , CHOFFNES D , et al . Understanding the security implications of DoT and DoH deployments [C ] // Proceedings of the Internet Measurement Conference . New York : ACM , 2020 : 347 - 361 .

HOUSER R , LI Z , COTTON C , et al . An investigation on information leakage of DNS over TLS [C ] // Proceedings of the 15th International Conference on Emerging Networking Experiments and Technologies . New York : ACM , 2019 : 123 - 137 .

BANADAKI Y . Detecting malicious DNS over HTTPS traffic in domain name system using machine learning classifiers [J ] . Journal of Computer Sciences and Applications , 2020 ( 8 ): 46 - 55 .

HU G N , FUKUDA K . An analysis of privacy leakage in DoQ traffic [C ] // Proceedings of the CoNEXT Student Workshop . New York : ACM , 2021 : 7 - 8 .

HOANG N P , AKHAVAN NIAKI A , BORISOV N , et al . Assessing the privacy benefits of domain name encryption [C ] // Proceedings of the 15th ACM Asia Conference on Computer and Communications Security . New York : ACM , 2020 : 290 - 304 .

ERIC R , KAZUHO O , NICK S , et al . TLS encrypted client hello [R ] . 2024 .

NIAKI A A , CHO S , WEINBERG Z , et al . ICLab: a global, longitudinal internet censorship measurement platform [C ] // Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2020 .

LI R X , LIU B J , LU C Y , et al . A worldwide view on the reachability of encrypted DNS services [C ] // Proceedings of the ACM Web Conference 2024 (WWW). New York: ACM, 2024 : 1193 - 1202 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Anomaly detection in DNS: an empirical study

Bidirectional privacy authorization for large models based on private set intersection

Research on searchable encryption scheme based on enhanced PIR

Differential privacy protection method for localization of ADS-B message positioning data oriented to LBS

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Related Author

HOU Ronghao

HE Ming

KONG Kaichuan

CHEN Yong

ZUO Peng

YANG Shuai

HAN Yiliang

WU Xuguang

Related Institution

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Key Laboratory of Counter-Terrorism Command Information Engineering of the Ministry of Education, Engineering University of PAP

College of Cryptography Engineering, Engineering University of PAP

College of Computer Science，Beijing Information Science and Technology University

⁰