Choi Dooho - Information Security Applications 17th International Workshop, WISA 2016, Jeju Island, Korea, August 25-27, 2016, Revised Selected Papers

Information Security Applications 17th International Workshop, WISA 2016, Jeju Island, Korea, August 25-27, 2016, Revised Selected Papers — read online for free the complete book (whole text) full work

Below is the text of the book, divided by pages. System saving the place of the last page read, allows you to conveniently read the book "Information Security Applications 17th International Workshop, WISA 2016, Jeju Island, Korea, August 25-27, 2016, Revised Selected Papers" online for free, without having to search again every time where you left off. Put a bookmark, and you can go to the page where you finished reading at any time.

Light

Font size:

↓

↑

Georgia Tahoma Arial Verdana

Reset

Interval:

↓

↑

Bookmark:

Make

1234567...158

Springer International Publishing AG 2017

Dooho Choi and Sylvain Guilley (eds.) Information Security Applications Lecture Notes in Computer Science 10144 10.1007/978-3-319-56549-1_1

Does Query Blocking Improve DNS Privacy?

Quantifying Privacy Under Partial Blocking Deployment

Aziz Mohaisen 1

(1)

University at Buffalo, State University of New York, Buffalo, New York, USA

Aziz Mohaisen (Corresponding author)

Email:

Ah Reum Kang

Email:

Kui Ren

Email:

Abstract

DNS leakage happens when queries for names within a private namespace spread out to the public DNS infrastructure (Internet), which has various privacy implications. An example of this leakage includes the documented [] proposed the special use .onion domain name, and various best practice recommendations of blocking of .onion strings (hidden service addresses) at the stub (browser), recursive, and authoritative resolvers. Without any form of analysis of those recommendations in practice, it is very difficult to tell how much of privacy is provided by following them in various deployment settings. In this paper, we initiate for the study of those recommendations by analyzing them under various settings and conclude that while the unlikely universal deployment will naturally improve privacy by preventing leakage, partial deployment, which is the case for early adoption, will degrade the privacy of individuals not adopting those recommendations.

Introduction

The domain name system (DNS) is an essential protocol used for naming and addressing of resources in private networks and on the public Internet. In private networks as well as the public Internet, DNS is usedamong other purposesfor mapping domain names to IP addresses. In private networks, however, one does not need to use a delegated top level domain (TLD) for naming hosts and services, and can use pseudo-TLDs, TLDs that are only recognizable within the private network. For example, pseudo-TLDs such .i2p, .onion, and .exit, among others, have been used as a standard suffix for naming services in various private networks. Among them, .onion has been used as the standard pseudo-TLD for naming hidden services in Tor. Queries initiated in the Tor network to .onion second level domains (SLDs) are routed within the Tor network, to aid the goal of hidden services, and are not intended for external use. If one is to query a .onion domain in the public DNS infrastructure, the query will be answered with an NXDOMAIN response ( i.e., nonexistent domain) from the root, because .onion is not delegated in the root DNS zone. In reality, under no circumstances, a private network query should be allowed in the public DNS infrastructure.

However, reality somewhat differs: it has been recently reported and systematically demonstrated [], calling for further exploration.

Given the special nature of some of the pseudo-TLDs like .onion, special considerations need to be taken into account to prevent their leakage. For example, given that .onion names are used for querying hidden services, an eavesdropper on the DNS resolution system (on various links) can associate the .onion query with a user, or reduce the potential number of users associated with that query to a tractable set size, thus breaching the privacy of the user. Roughly speaking, the privacy leakage here means that the adversary will be able to tell that a user (the set of all users) is interested in (a query among all queries), or a user (where ) is interested in q , where (potentially) . Here we are assuming that the adversary is residing on the public Internet, and does not have any control over the private network ( i.e., Tor).

To address this real scenario of leakage, Appelbaum and Muffet proposed in RFC 7686 [] the special use .onion domain name, and various best practice recommendations of blocking of .onion strings (hidden service addresses) at (i) the stub (browser), (ii) recursive, and (iii) authoritative resolvers (among other equally important best practice recommendations). The hope is that the deployment of such recommendations will improve the privacy of the users using Tor in general and hidden services in particular. No work, however, is done to assess the validity of such hope under any settings, let alone realistic deployment scenarios.

Contributions. In this paper we set out to analyze the privacy implications of blocking of the leaked DNS queries as a mean of improving the privacy of users. We initiate for such study by formalizing the adversary of a DNS system as a collection of capabilities on various links in the DNS resolution structure, as informally argued by Mohaisen and Mankin []. We use a well-defined advantage of the adversary to quantify the breached privacy of users over their queries with and without blocking and under various deployment scenarios captured by a parameterized model. We find out that while a universal deployment of such blocking strategies will naturally result in a great privacy benefit to users, such universal deployment is unlikely to happen immediately. As a result, a realistic analysis is drawn from partial deployment, in which we highlight the consequence of shared infrastructure like the DNS resolution system: the privacy of an individual does not only depend on his actions but also the actions of other users. In other words, we highlight scenarios where blocking by some users would make the matters worse for others who do not block.

Organization. The organization of the rest of this paper is as follows. In Sect. we draw concluding remarks.

Background

Domain Names and their Resolution. The DNS is a hierarchical naming system by design []), one of 13 root name servers is queried for the address of com those servers operate in anycast setting, where queries are routed to the geographically closest server among them. Upon receiving the address of com s authoritative name server, it is queried for the address of the authoritative name server of example , and so forth until the IP of the resource of interest for the full domain name is returned. In the plain DNS ( i.e., no security in place), a query for a name that does not exist is answered by NXDOMAIN response. Such response could be returned at any round of resolution of a hierarchical name, including by the root name server.

Resolution System. The above resolution procedure is only conceptual and does not take into account DNS optimizations geared towards improving the response time and manageability of the DNS resolution process by incorporating other entities. In particular, the DNS resolution system typically consists of three entities: stub resolvers (also called clients), recursive resolvers , and authoritative name servers (to simplify the analysis, one could view the authoritative name servers collectively as one of such servers). The stub resolver resides on the host, and forwards queries on behalf of a user to the recursive resolver, which is responsible for the iterative process of resolution above by querying the various authoritative name servers for addresses of names in a full domain name. The recursive resolver may also have caching capabilities , thus improving the latency for subsequent requests of previously resolved domain names.

Next page

1234567...158

Light

Font size:

↓

↑

Georgia Tahoma Arial Verdana

Reset

Interval:

↓

↑

Bookmark:

Make

Similar books «Information Security Applications 17th International Workshop, WISA 2016, Jeju Island, Korea, August 25-27, 2016, Revised Selected Papers»

Look at similar books to Information Security Applications 17th International Workshop, WISA 2016, Jeju Island, Korea, August 25-27, 2016, Revised Selected Papers. We have selected literature similar in name and meaning in the hope of providing readers with more options to find new, interesting, not yet read works.

Hein Venter

Information and Cyber Security: 19th International Conference, ISSA 2020, Pretoria, South Africa, August 25–26, 2020, Revised Selected Papers

Pantelimon Stănică (editor)

Security and Privacy: Select Proceedings of ICSP 2020 (Lecture Notes in Electrical Engineering, 744)

Mufti Mahmud

Applied Intelligence and Informatics: First International Conference, AII 2021, Nottingham, UK, July 30–31, 2021, Proceedings

Ken Barker

Data and Applications Security and Privacy XXXV: 35th Annual IFIP WG 11.3 Conference, DBSec 2021, Calgary, Canada, July 19-20, 2021 : Proceedings

Rafael Pass

Theory of Cryptography: 18th International Conference, TCC 2020, Durham, NC, USA, November 16–19, 2020, Proceedings, Part III

Seokhie Hong

Information security and cryptology - ICISC 2016: 19th international conference, Seoul, South Korea, November 30 - December 2, 2016: revised selected papers

Oikonomou Konstantinos

Algorithmic Aspects of Cloud Computing: Second International Workshop, ALGOCLOUD 2016, Aarhus, Denmark, August 22, 2016, Revised Selected Papers

Loia Vincenzo

Fuzzy Logic and Soft Computing Applications: 11th International Workshop, WILF 2016, Naples, Italy, December 19-21, 2016, Revised Selected Papers

Andress

Foundations of Information Security

Jeffrey James Stapleton

Security Without Obscurity: A Guide to Cryptographic Architectures

Chuck Easttom

Modern Cryptography: Applied Mathematics for Encryption and Information Security

Jon Edney

Real 802.11 Security: Wi-Fi Protected Access and 802.11i

Discussion, reviews of the book Information Security Applications 17th International Workshop, WISA 2016, Jeju Island, Korea, August 25-27, 2016, Revised Selected Papers and just readers' own opinions. Leave your comments, write what you think about the work, its meaning or the main characters. Specify what exactly you liked and what you didn't like, and why you think so.