Affiliation:
1. Princeton University ,
2. Salesforce ,
Abstract
Abstract
Virtually every Internet communication typically involves a Domain Name System (DNS) lookup for the destination server that the client wants to communicate with. Operators of DNS recursive resolvers—the machines that receive a client’s query for a domain name and resolve it to a corresponding IP address—can learn significant information about client activity. Past work, for example, indicates that DNS queries reveal information ranging from web browsing activity to the types of devices that a user has in their home. Recognizing the privacy vulnerabilities associated with DNS queries, various third parties have created alternate DNS services that obscure a user’s DNS queries from his or her Internet service provider. Yet, these systems merely transfer trust to a different third party. We argue that no single party ought to be able to associate DNS queries with a client IP address that issues those queries. To this end, we present Oblivious DNS (ODNS), which introduces an additional layer of obfuscation between clients and their queries. To do so, ODNS uses its own authoritative namespace; the authoritative servers for the ODNS namespace act as recursive resolvers for the DNS queries that they receive, but they never see the IP addresses for the clients that initiated these queries. We present an initial deployment of ODNS; our experiments show that ODNS introduces minimal performance overhead, both for individual queries and for web page loads. We design ODNS to be compatible with existing DNS protocols and infrastructure, and we are actively working on an open standard with the IETF.
Reference43 articles.
1. [1] Allman, M. Case Connection Zone DNS Transactions, 2011–2017. http://www.icir.org/mallman/data.html.
2. [2] Andersen, D. G., Balakrishnan, H., Feamster, N., Koponen, T., Moon, D., and Shenker, S. Accountable internet protocol (AIP). SIGCOMM Comput. Commun. Rev. 38, 4 (Aug. 2008), 339–350.
3. [3] Appelbaum, J., and Muffett, A. The “.onion” special-use domain name. RFC 7686, October 2015.
4. [4] Arends, R., Austein, R., Larson, M., Massey, D., and Rose, S. DNS security introduction and requirements. RFC 4033, March 2005. http://www.rfc-editor.org/rfc/rfc4033.txt.
5. [5] Bernstein, D. J. Curve25519: New Diffie-Hellman speed records. In Public Key Cryptography - PKC 2006 (Berlin, Heidelberg, 2006).
Cited by
18 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献