Measuring the Accessibility of Domain Name Encryption and Its Impact on Internet Filtering
Measuring the Accessibility of Domain Name Encryption and Its Impact on Internet Filtering
复制标题
衡量域名加密的可访问性及其对互联网过滤的影响
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Phillipa Gill
中科院分区：
文献类型：
--
作者：
Nguyen Phong Hoang;M. Polychronakis;Phillipa Gill
大多数在线通信依赖于DNS将域名映射到它们的主机IP地址。先前的工作表明，由于原始DNS协议的未加密和未经身份验证的性质，基于DNS的网络干扰很普遍。除了DNS之外，当使用SNI扩展时，访问的域名也可以在TLS握手期间由路径上的观察者监视。暴露的明文域名的这些挥之不去的问题导致了新一代协议的发展，这些协议使被访问的域名隐藏起来。DoT （DNS-over- tls）和DoH （DNS-over- https）隐藏DNS查询的域名，而ESNI （Encrypted Server Name Indication）对SNI扩展中的域名进行加密。我们提出了DNEye，一个建立在分布式优势点网络之上的测量系统，我们用它来研究DoT/DoH和ESNI的可访问性，并调查这些协议是否被网络提供商篡改（例如，为了审查）。此外，我们评估了这些协议在访问被传统DNS操作阻止的内容时规避网络干扰的功效。我们发现有证据表明，在包括中国、俄罗斯和沙特阿拉伯在内的几个国家，针对域名加密技术采取了屏蔽措施。同时，我们发现域名加密可以帮助解锁中国和其他国家超过55%和95%的审查域名，其中基于dns的过滤大量使用。
Most online communications rely on DNS to map domain names to their hosting IP address(es). Previous work has shown that DNS-based network interference is widespread due to the unencrypted and unauthenticated nature of the original DNS protocol. In addition to DNS, accessed domain names can also be monitored by on-path observers during the TLS handshake when the SNI extension is used. These lingering issues with exposed plaintext domain names have led to the development of a new generation of protocols that keep accessed domain names hidden. DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH) hide the domain names of DNS queries, while Encrypted Server Name Indication (ESNI) encrypts the domain name in the SNI extension. We present DNEye, a measurement system built on top of a network of distributed vantage points, which we used to study the accessibility of DoT/DoH and ESNI, and to investigate whether these protocols are tampered with by network providers (e.g., for censorship). Moreover, we evaluate the efficacy of these protocols in circumventing network interference when accessing content blocked by traditional DNS manipulation. We find evidence of blocking efforts against domain name encryption technologies in several countries, including China, Russia, and Saudi Arabia. At the same time, we discover that domain name encryption can help with unblocking more than 55% and 95% of censored domains in China and other countries where DNS-based filtering is heavily employed.
了解加密 DNS 对互联网审查的影响
DOI：
10.1145/3442381.3450084
发表时间：
2021
期刊：
WWW '21: Proceedings of the Web Conference 2021
影响因子：
--
作者：
Jin, Lin;Hao, Shuai;Wang, Haining;Cotton, Chase
通讯作者：
Cotton, Chase
DOI：
10.1109/sp40000.2020.00014
发表时间：
2019-07
期刊：
2020 IEEE Symposium on Security and Privacy (SP)
影响因子：
--
作者：
Arian Akhavan Niaki;Shinyoung Cho;Zachary Weinberg;Nguyen Phong Hoang;Abbas Razaghpanah;Nicolas Christin;Phillipa Gill
通讯作者：
Arian Akhavan Niaki;Shinyoung Cho;Zachary Weinberg;Nguyen Phong Hoang;Abbas Razaghpanah;Nicolas Christin;Phillipa Gill