递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析

段丽莹; 李瑞烜; 刘西蒙; 邵俊; 刘保君

doi:10.11959/j.issn.2096-109x.2024067

您当前的位置：

首页 >

文章列表页 >

递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析

专题：互联网域名安全 | 更新时间：2024-12-20

- 递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析
- Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers
- 网络与信息安全学报 2024年10卷第5期页码：71-80
- 作者机构：
  
  1.福州大学计算机与大数据学院，福建福州 350108
  2.清华大学网络科学与网络空间研究院，北京 100084
  3.浙江工商大学计算机科学与技术学院，浙江杭州 310018
- 作者简介：
  
  [ "段丽莹（2000- ），女，湖南株洲人，福州大学硕士生，主要研究方向为网络安全与互联网测量。" ]
  [ "李瑞烜（1999- ），男，山西忻州人，硕士，清华大学工程师，主要研究方向为网络安全与互联网测量。" ]
  [ "刘西蒙（1988- ），男，陕西西安人，博士，福州大学教授、博士生导师，主要研究方向为密码学与人工智能安全。" ]
  [ "邵俊（1981- ），男，浙江金华人，博士，浙江工商大学教授，主要研究方向为网络安全与密码学。" ]
  [ "刘保君（1994- ），男，安徽宿州人，博士，清华大学助理教授、博士生导师，主要研究方向为域名安全、网络测量、网络犯罪检测。" ]
- 基金信息：
  
  国家重点研发计划青年科学家项目(2023YFB3105600)
- DOI：10.11959/j.issn.2096-109x.2024067
  中图分类号： TP393
- 收稿：2024-05-30，
  
  修回：2024-08-22，
  
  纸质出版：2024-10-25
- 稿件说明：
移动端阅览
段丽莹, 李瑞烜, 刘西蒙, 等. 递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析[J]. 网络与信息安全学报, 2024, 10(5): 71-80.

Format: DUAN L Y, LI R X, LIU X M, et al. Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 71-80.
段丽莹, 李瑞烜, 刘西蒙, 等. 递归-权威侧部署加密DNS协议的隐私收益评估方法及测量分析[J]. 网络与信息安全学报, 2024, 10(5): 71-80. DOI： 10.11959/j.issn.2096-109x.2024067.

Format: DUAN L Y, LI R X, LIU X M, et al. Measurement and evaluation for privacy benefits of deploying encrypted DNS protocol between recursive and authoritative servers[J]. Chinese Journal of Network and Information Security, 2024, 10(5): 71-80. DOI： 10.11959/j.issn.2096-109x.2024067.

摘要

加密DNS协议最初被设计用于保护用户和递归解析器之间（用户-递归侧）的DNS通信隐私。目前，加密DNS协议获得了广泛应用。然而，递归解析器和权威服务器之间（递归-权威侧）的DNS通信仍遭受着大量隐私威胁。历经4年的标准化进程，互联网工程任务组在2024年2月正式发布RFC 9539，提出可利用加密DNS协议来保障递归-权威侧的DNS通信隐私。聚焦于在递归-权威侧部署加密DNS协议所带来的隐私收益，提出评估互联网域名隐私收益的方法。针对243万个流行域名和4万个敏感域名，结合1 058个顶级域名的区域文件，分析权威服务器所托管的域名数量，从而判定目标域名的隐私收益等级。测量结果表明，超过90%的域名可获得递归-权威侧部署加密DNS协议的隐私保护，但是6.28%的敏感域名无法从递归-权威侧部署加密DNS协议中获得隐私收益。此外，一些高流行度的域名也没有获得足够的隐私收益。相较于大型域名托管商，小型域名托管商可为域名提供更高的隐私收益。将域名部署于仅托管单个域名的权威服务器上会极大地损害递归-权威侧加密DNS协议的隐私保护效果，管理人员应重新审视域名托管服务。

Abstract

The encrypted DNS protocol was originally designed to protect DNS communication privacy between users and recursive resolvers (user-recursive side). Currently

encrypted DNS communication has been widely deployed. However

DNS communications between recursive resolvers and authoritative servers (recursive-authoritative side) still faced significant privacy threats. To address this issue

the Internet Engineering Task Force (IETF) officially released RFC 9539 in February 2024

which utilized the encrypted DNS protocol to protect DNS communication privacy on the recursive-authoritative side. Focusing on the privacy benefits of deploying the encrypted DNS protocol on the recursive-authoritative side

a method to evaluate the privacy benefits of domain names was proposed. The method defined three levels of privacy benefits by analyzing the number of domain names hosted by authoritative servers of the target domain name. Combined with the zone files of 1058 top-level domains

the privacy benefit level was determined for 2.43 million popular domain names and 40 thousand sensitive domain names. The results showed that over 90% of domain names could achieve privacy protection through the deployment of encrypted DNS on the recursive-authoritative side. However

6.28% of sensitive domain names could not benefit from such deployment. In addition

some popular domain names also did not gain privacy benefits. Compared to large domain hosting providers

smaller providers could offer higher privacy benefits for domain names. Administrators were advised not to deploy domains on authoritative servers that hosted only a single domain name

which significantly compromised the privacy protection effectiveness of encrypted DNS protocol deployment on the recursive-authoritative side.

关键词

Keywords

references

LIU B , LU C , DUAN H , et al . Who is answering my queries: understanding and characterizing interception of the DNS resolution path [C ] // Proceedings of the 2019 Applied Networking Research Workshop (ANRW) . New York : Association for Computing Machinery , 2019 : 15 - 16 .

HU Z , ZHU L , HEIDEMANN J , et al . Specification for DNS over transport layer security (TLS) [R ] . 2016 .

HOFFMAN P , MCMANUS P . DNS queries over HTTPS (DoH) [R ] . 2018 .

HUITEMA C , DICKINSON S , MANKIN A . DNS over dedicated QUIC connections [R ] . 2022 .

BISHOP M . HTTP/3 [R ] . 2022 .

JENSEN T , PASHOV I , MONTENEGRO G . Windows will improve user privacy with DNS over HTTPS [J ] . Retrieved May , 2019 , 15 : 2020 .

LI R , JIA X , ZHANG Z , et al . A longitudinal and comprehensive measurement of dns strict privacy [J ] . IEEE/ACM Transactions on Networking , 2023 , 31 ( 6 ): 2793 - 2808 .

ED T W . DNS privacy considerations [R ] . 2021 .

PETIT-HUGUENIN M , SALGUEIRO G , ROSENBERG J . Session traversal utilities for NAT (STUN) extension for third-party authorization [R ] . 2021 .

STÉPHANE BORTZMEYER . DNS privacy considerations [R ] . 2015 .

LU C Y , LIU B J , LI Z , et al . An end-to-end, large-scale measurement of DNS-over-encryption: how far have we come [C ] // Proceedings of the Internet Measurement Conference . New York : ACM , 2019 : 22 - 35 .

KOSEK M , DOAN T V , GRANDERATH M , et al . One to rule them all? a first look at DNS over QUIC [C ] // Proceedings of the International Conference on Passive and Active Network Measurement . Cham : Springer , 2022 : 537 - 551 .

BÖTTGER T , CUADRADO F , ANTICHI G , et al . An empirical study of the cost of DNS-over-HTTPS [C ] // Proceedings of the Internet Measurement Conference . New York : ACM , 2019 : 15 - 21 .

CHUNG T , VAN RIJSWIJK-DEIJ R , CHOFFNES D , et al . Understanding the security implications of DoT and DoH deployments [C ] // Proceedings of the Internet Measurement Conference . New York : ACM , 2020 : 347 - 361 .

HOUSER R , LI Z , COTTON C , et al . An investigation on information leakage of DNS over TLS [C ] // Proceedings of the 15th International Conference on Emerging Networking Experiments and Technologies . New York : ACM , 2019 : 123 - 137 .

BANADAKI Y . Detecting malicious DNS over HTTPS traffic in domain name system using machine learning classifiers [J ] . Journal of Computer Sciences and Applications , 2020 ( 8 ): 46 - 55 .

HU G N , FUKUDA K . An analysis of privacy leakage in DoQ traffic [C ] // Proceedings of the CoNEXT Student Workshop . New York : ACM , 2021 : 7 - 8 .

HOANG N P , AKHAVAN NIAKI A , BORISOV N , et al . Assessing the privacy benefits of domain name encryption [C ] // Proceedings of the 15th ACM Asia Conference on Computer and Communications Security . New York : ACM , 2020 : 290 - 304 .

ERIC R , KAZUHO O , NICK S , et al . TLS encrypted client hello [R ] . 2024 .

NIAKI A A , CHO S , WEINBERG Z , et al . ICLab: a global, longitudinal internet censorship measurement platform [C ] // Proceedings of the 2020 IEEE Symposium on Security and Privacy (SP) . Piscataway : IEEE Press , 2020 .

LI R X , LIU B J , LU C Y , et al . A worldwide view on the reachability of encrypted DNS services [C ] // Proceedings of the ACM Web Conference 2024 (WWW). New York: ACM, 2024 : 1193 - 1202 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

DNS异常检测：大规模实验分析

基于隐私集合求交的大模型双向隐私授权

基于PIR增强的可搜索加密方案研究

面向LBS的ADS-B报文定位数据本地化差分隐私保护方法

FL-IoV：基于联邦学习的综合车联网入侵检测方法