Understanding the Impact of Encrypted DNS on Internet Censorship
Understanding the Impact of Encrypted DNS on Internet Censorship
复制标题
了解加密 DNS 对互联网审查的影响
DOI：
10.1145/3442381.3450084
复制
发表时间：
2021
期刊：
影响因子：
--
通讯作者：
Cotton, Chase
中科院分区：
文献类型：
--
作者：
Jin, Lin;Hao, Shuai;Wang, Haining;Cotton, Chase
DNS流量以明文传输，导致隐私泄露。为了解决这个问题，已经使用安全协议来加密DNS消息。现有的研究已经调查了加密DNS通信的性能开销和隐私优势，但很少从审查的角度进行研究。本文从两个方面研究了加密DNS对互联网审查的影响。一方面，我们探讨了DNS操纵的严重性，考虑到加密DNS解析器的使用，这可能会被用于互联网审查。特别是，我们对3，813个DoT和75个DoH解析器执行了740万次DNS查找测量，并确定1.66%的DoT响应和1.42%的DoH响应进行了DNS操作。更重要的是，我们观察到超过三分之二的DoT和DoH解析器操纵来自至少一个域的DNS响应，这表明DNS操纵在加密DNS中很普遍，可以进一步利用加密DNS来加强互联网审查。另一方面，我们评估使用加密DNS解析器规避审查的有效性。具体来说，我们首先发现那些Vantage位置，涉及DNS操纵通过路径上的设备，然后我们在这些Vantage位置应用加密的DNS解析器来访问审查域。我们发现，37%的域名可以从中国的Vantage位置访问，但没有一个域名可以从伊朗的Vantage位置访问，这表明使用加密DNS解析器的审查规避因国家而异。此外，从Vantage的角度来看，使用不同的加密DNS解析器不会导致访问审查域的明显差异。
DNS traffic is transmitted in plaintext, resulting in privacy leakage. To combat this problem, secure protocols have been used to encrypt DNS messages. Existing studies have investigated the performance overhead and privacy benefits of encrypted DNS communications, yet little has been done from the perspective of censorship. In this paper, we study the impact of the encrypted DNS on Internet censorship in two aspects. On one hand, we explore the severity of DNS manipulation, which could be leveraged for Internet censorship, given the use of encrypted DNS resolvers. In particular, we perform 7.4 million DNS lookup measurements on 3,813 DoT and 75 DoH resolvers and identify that 1.66% of DoT responses and 1.42% of DoH responses undergo DNS manipulation. More importantly, we observe that more than two-thirds of the DoT and DoH resolvers manipulate DNS responses from at least one domain, indicating that the DNS manipulation is prevalent in encrypted DNS, which can be further exploited for enhancing Internet censorship. On the other hand, we evaluate the effectiveness of using encrypted DNS resolvers for censorship circumvention. Specifically, we first discover those vantage points that involve DNS manipulation through on-path devices, and then we apply encrypted DNS resolvers at these vantage points to access the censored domains. We reveal that 37% of the domains are accessible from the vantage points in China, but none of the domains is accessible from the vantage points in Iran, indicating that the censorship circumvention of using encrypted DNS resolvers varies from country to country. Moreover, for a vantage point, using a different encrypted DNS resolver does not lead to a noticeable difference in accessing the censored domains.
登录
查看更多内容
OONI：网络干扰开放观测站
DOI：
--
发表时间：
2012
期刊：
IEEE Symposium on Foundations of Computational Intelligence
影响因子：
--
作者：
Arturo Filastò;Jacob Appelbaum
通讯作者：
Jacob Appelbaum
光线照进来的地方：分析印度的网络审查机制
DOI：
--
发表时间：
2018
期刊：
ACM/SIGCOMM Internet Measurement Conference
影响因子：
--
作者：
T. Yadav;Akshat Sinha;D. Gosain;P. Sharma;Sambuddho Chakravarty
通讯作者：
Sambuddho Chakravarty
DOI：
10.1145/3320269.3384728
发表时间：
2019
期刊：
Proceedings of the 15th ACM Asia Conference on Computer and Communications Security
影响因子：
--
作者：
Nguyen Phong Hoang;Arian Akhavan Niaki;N. Borisov;Phillipa Gill;M. Polychronakis
通讯作者：
M. Polychronakis
DOI：
10.17487/rfc7858
发表时间：
2016-05
期刊：
RFC
影响因子：
--
作者：
Zi Hu;Liang Zhu;John S. Heidemann;A. Mankin;Duane Wessels;Paul E. Hoffman
通讯作者：
Zi Hu;Liang Zhu;John S. Heidemann;A. Mankin;Duane Wessels;Paul E. Hoffman
DOI：
10.1145/2793013.2793015
发表时间：
2015
期刊：
Proceedings of the 2015 ACM SIGCOMM Workshop on Ethics in Networked Systems Research
影响因子：
--
作者：
Ben Jones;Roya Ensafi;N. Feamster;V. Paxson;N. Weaver
通讯作者：
N. Weaver