An investigation on information leakage of DNS over TLS
An investigation on information leakage of DNS over TLS
复制标题
DNS over TLS信息泄露调查
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Haining Wang
中科院分区：
文献类型：
--
作者：
Rebekah Houser;Zhou Li;Chase Cotton;Haining Wang
DNS over TLS （DoT）通过对用户和解析器之间传输的DNS消息进行加密，保护DNS通信的机密性和完整性。近年来，DoT已被流行的递归解析器（如Cloudflare和谷歌）部署。虽然DoT应该防止路径上的对手学习和篡改受害者的DNS请求和响应，但目前还不清楚通过对DoT消息的流量分析可以推断出多少信息。为了回答这个问题，在这项工作中，我们开发了一种DoT指纹方法来分析DoT流量，并确定用户是否访问了对手感兴趣的网站。考虑到访问一个网站通常会引入一系列DNS数据包，我们可以通过对数据包大小的时间模式建模来推断访问的网站。在没有填充DNS消息的情况下，我们的方法可以识别出假阴性率小于17%、假阳性率小于0.5%的网站DoT流量。此外，我们还表明，即使填充了DoT消息，信息泄漏仍然是可能的。这些发现突出了保护DNS隐私的挑战，并指出了对DNS通信潜在威胁进行彻底分析以实现有效防御的必要性。
DNS over TLS (DoT) protects the confidentiality and integrity of DNS communication by encrypting DNS messages transmitted between users and resolvers. In recent years, DoT has been deployed by popular recursive resolvers like Cloudflare and Google. While DoT is supposed to prevent on-path adversaries from learning and tampering with victims' DNS requests and responses, it is unclear how much information can be deduced through traffic analysis on DoT messages. To answer this question, in this work, we develop a DoT fingerprinting method to analyze DoT traffic and determine if a user has visited websites of interest to adversaries. Given that a visit to a website typically introduces a sequence of DNS packets, we can infer the visited websites by modeling the temporal patterns of packet sizes. Our method can identify DoT traffic for websites with a false negative rate of less than 17% and a false positive rate of less than 0.5% when DNS messages are not padded. Moreover, we show that information leakage is still possible even when DoT messages are padded. These findings highlight the challenges of protecting DNS privacy, and indicate the necessity of a thorough analysis of the threats underlying DNS communications for effective defenses.
DOI：
10.1145/3243734.3243832
发表时间：
2018
期刊：
Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security
影响因子：
--
作者：
Li, Shuai;Guo, Huajun;Hopper, Nicholas
通讯作者：
Hopper, Nicholas
如果可以的话缓存我：DNS 生存时间的影响
DOI：
10.1145/3355369.3355568
发表时间：
2019
期刊：
ACM Interent Measurements Conference
影响因子：
--
作者：
Moura, Giovane C.;Heidemann, John;Schmidt, Ricardo de;Hardaker, Wes
通讯作者：
Hardaker, Wes