数据与计算发展前沿 ›› 2021, Vol. 3 ›› Issue (3): 75-85.doi: 10.11871/jfdc.issn.2096-742X.2021.03.007

• 网络通信与安全专刊 • 上一篇    下一篇

基于多解析器的域名隐私保护机制

吴一铭1,2,*(),王伟1(),延志伟3(),汪洋1()   

  1. 1.中国科学院计算机网络信息中心,北京 100190
    2.中国科学院大学,北京 100049
    3.中国互联网络信息中心,北京 100190
  • 收稿日期:2021-03-04 出版日期:2021-06-20 发布日期:2021-07-09
  • 通讯作者: 吴一铭
  • 作者简介:吴一铭,中国科学院计算机网络信息中心,在读硕士研究生,主要研究方向为域名系统。
    本文中主要负责文献调研,实验设计与实现,内容撰写。
    WU Yiming is a graduate student at Computer Network Information Center, Chinese Academy of Sciences. His main research directions is domain name system.
    In this paper, he is mainly responsible for literature research, experiment design and implementation, and content writing.
    E-mail: wuyiming@cnic.cn|王 伟,中国科学院计算机网络信息中心,研究员,博士生导师,主要研究方向为下一代互联网架构、互联网可信体系、网络信息安全。
    本文中主要负责背景研究,思路指导,总体统稿。
    WANG Wei is a researcher and PhD supervisor at Computer Network Information Center, Chinese Academy of Sciences. His main research interests are next-generation Internet architecture, Internet trustworthy system, and network infor-mation security.
    In this paper, he is mainly responsible for background research, idea guidance, and overall unification.
    E-mail: wangwei@cnic.cn|延志伟,中国互联网络信息中心,研究员,博士,主要研究方向为互联网命名(寻址)、路由安全体系。
    本文中主要负责整体框架设计与指导工作。
    YAN Zhiwei, Ph.D., is a researcher at China Internet Network Information Center. His main research direction is Internet naming (addressing) and routing security system.
    In this paper, he is mainly responsible for the overall frame-work design and guidance.
    E-mail: yanzhiwei@cnnic.cn|汪洋,中国科学院计算机网络信息中心,博士,中国科学院计算机网络信息中心信息化发展战略与评估中心主任,主要研究方向为信息化发展战略研究、大数据分析、态势感知系统。
    为本文的实验方法和写作提出建议和指导。
    WANG Yang, Ph.D., is the director of the Information Develop-ment Strategy and Evaluation Center of Computer Network Information Center, Chinese Academy of Sciences. His main research directions are informatization development strategy research, big data analysis, situation awareness system.
    In this paper, he provides suggestions and guidance for the experimental methods and paper composition.
    E-mail: wangyang@cnic.cn
  • 基金资助:
    北京市科技新星计划项目(Z191100001119113)

Multi-Resolver-Based Privacy Protection Mechanism for Domain Names

WU Yiming1,2,*(),WANG Wei1(),YAN Zhiwei3(),WANG Yang1()   

  1. 1. Computer Network Information Center, Chinese Academy of Sciences, Beijing 100190, China
    2. University of Chinese Academy of Sciences, Beijing 100049, China
    3. China Internet Network Information Center, Beijing 100190, China
  • Received:2021-03-04 Online:2021-06-20 Published:2021-07-09
  • Contact: WU Yiming

摘要:

【目的】 作为互联网重要的基础架构,DNS系统在最初设计时没有对协议的安全性进行考虑,DNS查询和响应都是以明文形式传输的,因此容易受到窃听和流量分析的影响。随着互联网的发展,DNS的安全和隐私问题越来越受到重视,已经出现了多种扩展的DNS加密协议来解决传输过程的数据保护。但是,这些DNS加密传输协议未能解决DNS递归解析器对用户隐私的收集问题,其实现和部署方式反而加速了DNS解析体系的集中化,导致DNS服务端的隐私问题愈发严重。【方法】 本文研究的多解析器机制通过向多个候选DNS解析器分散用户的查询请求,实现集中化缓解和DNS服务端用户隐私保护。通过对机制核心问题选择策略的研究,本文提出了一种改进的轮询选择方法,该方法通过在客户端维护一个查询记录表保证域名-解析器之间的固定关系,减少暴露在每个单独解析器上的用户浏览活动信息量,避免某个解析器获取用户的整个网页浏览历史。此外,基于解析器ping延迟的加权轮询方法作为更进一步的改进方案,对多解析器机制的域名解析延迟进行优化,以在隐私分散保护和性能之间取得平衡。【结果】 实验表明改进的轮询方式可以有效地完成多解析器机制的设计目标,将用户的域名解析请求最大程度的在候选解析器之间进行分散,而基于ping延迟的加权轮询方法虽然分散效果有所降低但获得了显著的性能提升。【结论】 通过不同选择策略的横向对比,本文提出的改进轮询方法和加权轮询方法分别在分散效果和解析性能上有着明显优势。基于本文方法的多解析器机制为解决当前的DNS隐私问题和集中化问题提供了一个可行的方案。

关键词: DNS, 隐私保护, DNS over HTTPS

Abstract:

[Objective] As an important infrastructure of the Internet, the DNS system was not initially designed with protocol security in mind, and DNS queries and responses are transmitted in plaintext, making it vulnerable to eavesdropping and traffic analysis. With evolution of the Internet, DNS security and privacy concerns have received increasing attention, variants of extended DNS encryption protocols have emerged to address the data protection issue during transmission. However, these DNS encryption transfer protocols fail to prevent the collection of user privacy by DNS recursive resolvers. Instead, the implementation and deployment of those protocols accelerate the centralization of the DNS resolution system, leading to increasingly serious privacy issues on the DNS server side. [Methods] The multi-resolver mechanism studied in this paper achieves centralization mitigation and DNS server-side user privacy protection by dispersing user query requests to multiple candidate DNS resolvers. By studying the selection strategy which is the core issue of the mechanism, this paper proposes an improved round robin selection method, which ensures a fixed relationship among domain-name resolvers by maintaining a query record table on the client side, reduces the amount of information about user browsing activities exposed to each individual resolver, and avoids a particular resolver from obtaining a user's entire web browsing history. In addition, a weighted round robin approach based on resolver ping latency is used as a further improved scheme to optimize the domain name resolution latency of the multi-resolver mechanism in order to strike a balance between privacy decentralization protection and performance.[Results] The experiments show that the improved round robin approach can effectively achieve the design goal of maximizing the dispersion of user's domain name resolution requests among the candidate resolvers, and the weighted round robin approach based on ping delay achieves significant performance improvement at the cost of a reduced dispersion effect. [Conclusions] Through the comparison of different selection strategies, the improved round robin method and the weighted round robin method proposed in this paper have shown advantages in the decentralization effect and resolution performance, respectively. The multi-resolver mechanism proposed in this paper provides a feasible solution to solve the privacy and centralization problems of the current DNS.

Key words: DNS, privacy protection, DNS over HTTPS