Privacy analysis of DNS resolver solutions J.H.C. van Heugten - PowerPoint PPT Presentation

Privacy analysis of DNS resolver solutions J.H.C. van Heugten University of Amsterdam MSc System and Network Engineering July 3, 2018 J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 1 / 14

Introduction ”We’ve updated our privacy policy” J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 2 / 14

Introduction Research question: How can modern techniques improve the privacy of DNS users? Regular DNS resolution The problem of DNS privacy Modern techniques to solve this Combine techniques for the best result J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 3 / 14

DNS resolution 1/2 J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 4 / 14

DNS resolution 2/2 DNS server types Stub resolver Recursive resolver Forwarding resolver Authoritative server Recursive/forwarder locations Local Remote ISP Public J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 5 / 14

The problem of DNS privacy Eavesdropping & MITM DNS data: QNAME QTYPE IP-addresses Responses Metadata (TTL, flags, etc.) EDNS(0) Client subnet Client ID DNSSEC J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 6 / 14

Privacy techniques DNS-over-TLS DNS-over-HTTPS DNSCrypt Oblivious DNS DNSCurve QNAME minimisation J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 7 / 14

Privacy techniques Query Name (QNAME) minimisation J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 8 / 14

Privacy techniques Coverage of techniques J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 9 / 14

Combining techniques Combining previous techniques and resolver types/locations together. Techniques not available to the user: Oblivious DNS DNSCurve Do not use the ISP’s resolver Regulation No support for techniques IP-address to user relation J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 10 / 14

Combining techniques Who do you trust with your data? J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 11 / 14

Combining techniques Decouple data over different servers And share the forwarding resolver with trusted friends... J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 12 / 14

Conclusion Conclusion Work done Importance of caching Recursive resolver selection (ECS, logging) Discussion & future work: TLS SNI DNS padding Overlay networks (Tor) Multiple public resolvers J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 13 / 14

Acknowledgements Supervisors Ralph Dolmans, NLnet Labs Martin Hoffmann, NLnet Labs J.H.C. van Heugten (UvA) DNS privacy July 3, 2018 14 / 14