The recursive resolver never sees the domains that the client queries, and the ODNS resolver never sees the IP address of the client. A client sends an encrypted query to a recursive resolver, which then forwards the query to a ODNS resolver (an authoritative DNS server that can resolve ODNS queries). ODNS decouples client identity from queries by leveraging the behavior of the global DNS system itself. ODNS operates in the context of the existing DNS protocol, allowing the existing deployed infrastructure to remain unchanged. To do so, we design, implement, and deploy Oblivious DNS (ODNS), which (1) obfuscates the queries that a recursive resolver sees from the clients that issue DNS queries and (2) obfuscates the client’s IP address from upper levels of the DNS hierarchy that ultimately resolve the query ( i.e., the authoritative servers). This work takes a different tack: Instead of merely shifting the trust anchor from an ISP to some other third party, we seek to prevent a recursive DNS resolver from associating client identities with the queries they make. Individual queries and for web page loads, and is compatible with existing DNS
We present an initial deployment of ODNS ourĮxperiments show that ODNS introduces minimal performance overhead, both for That they receive, but they never see the IP addresses for the clients that
Servers for the ODNS namespace act as recursive resolvers for the DNS queries To do so, ODNS uses its own authoritative namespace the authoritative Introduces an additional layer of obfuscation between clients and their To this end, we present Oblivious DNS (ODNS), which Single party should be able to associate DNS queries with a client IP address Systems merely transfer trust to a different third party. Queries, various third parties have created alternate DNS services that obscureĪ user's DNS queries from his or her Internet service provider. Recognizing the privacy vulnerabilities associated with DNS Queries reveal information ranging from web browsing activity to the types ofĭevices that a user has in his or her home (and the extent to which they areīeing used). Past work, for example, indicates that DNS Ultimately return the IP address to the client-can learn significant Query for a domain name, resolve it to a corresponding IP address, and Operators of DNS recursive resolvers-the machines that receive a client's Lookup for the destination server that the client wants to communicate with. Every Internet communication typically involves a Domain Name System (DNS)
0 kommentar(er)
