The traditional Domain Name System (DNS) lacks fundamental security and privacy features in its design. As privacy concerns increased on the Internet, security and privacy enhancements of DNS have been actively investigated. Specifically, in the context of user privacy in DNS queries, several relay-based anonymization schemes have been recently introduced. However, these schemes are vulnerable to collusion between relays and full-service resolvers, which means user identities cannot be hidden from resolvers. This paper introduces a new concept for achieving user anonymity in DNS queries through a multiple-relay-based approach, called μODNS (Mutualized Oblivious DNS), by extending the concept of existing relay-based schemes. μODNS introduces a reasonable assumption that each user has at least one trusted or dedicated relay within the network and mutually shares the relay with other users. The user simply sets his trusted relay as the next-hop relay to convey his queries to the resolver and randomly chooses its zero or more subsequent relays shared by other entities. Under this assumption, the user’s identity remains concealed from the target resolver in μODNS even if an unknown subset of relays colludes with the resolver. Namely, in μODNS, users can preserve their anonymity by paying a small cost of sharing their resources. Additionally, we extend existing protocols, Anonymized DNSCrypt and Oblivious DoH, to provide practical Proof-of-Concept specifications and implementations as instances of μODNS. These implementations are publicly available on the Internet as open-source software and public services. Furthermore, we demonstrate, through measurements of round-trip times for DNS messages, that our implementation can minimize the performance degradation resulting from its privacy enhancements, achieving performance levels that maintain the positive user experiences observed in existing schemes.
Read full abstract