DNS cache timing attack defense method based on time confusion strategy

Abstract

The invention discloses a DNS cache timing attack defense method based on a time confusion strategy, and the method comprises the steps: setting a recorder for storing the IP address of a querier for each user message which carries out DNS query; the server checks the cache record after receiving the DNS query, and performs different responses according to whether the IP address of the querier performs the resource record of the DNS; if the DNS query cache is hit and the querier IP exists in the recorder, directly performing DNS response; if the IP of the querier does not exist in the recorder, implementing a time confusion strategy, storing the IP address of the querier in the recorder, and then carrying out DNS response; if the DNS query cache is not hit, a recursive analysis process specified by a DNS protocol is carried out, and an IP address of a querier is stored in a recorder; and for the recorder, the server regularly refreshes all cached IP records. By utilizing the method, timing judgment of an attacker can be completely prevented in practice, so that the attacker cannot obtain any privacy information due to attack.

Description

Technical Field

[0001] The present invention belongs to the field of network security, and in particular relates to a DNS cache timing attack defense method based on a time obfuscation strategy. Background Art

[0002] Timing attacks are a side-channel method that aims to infer sensitive information by measuring the timing of key system operations, posing a threat. Compared to traditional attack methods, timing attacks do not require system intrusion or complex operations such as message forging. They rely solely on passive time monitoring. Therefore, some protections based on encrypted communications cannot prevent timing attacks, and traditional security mechanisms such as firewalls cannot identify the threat. Furthermore, because timing attacks rely on time precision in the side channel, they only require sufficiently accurate interactions and timers. They are easy to implement and pose minimal risk, making them a promising target for attackers.

[0003] The problem arises from the use of DNS caching. Adding caching to various stages can effectively improve resolution efficiency and reduce the load on authoritative servers. Adding caching at the client application level ensures that the same query results are immediately available and usable within a certain period of time, eliminating the need to send DNS queries to the recursive resolver. Recursive resolvers can cache popular domain names to more quickly respond to repeated recursive query requests for the same domain name. Hierarchical caching of intermediate results during the recursive query process can improve the efficiency of the overall recursive query.

[0004] The DNS protocol specifies a TTL (Time To Live) field, which indicates how long a resource record should remain in the cache. If this timeout occurs, a new resource record should be queried again. The TTL is set and managed by the authoritative server and provided to the recursive resolver cache in the DNS response. The recursive resolver also returns a TTL message to the client when processing the response, indicating the remaining time the resource record will remain in the recursive resolver's cache.

[0005] While caching can improve DNS resolution efficiency, it also introduces numerous security risks, such as providing opportunities for timing attacks. Specifically, authoritative servers set accurate TTLs for resource records to control their lifetime in the cache, and this information is accessible to attackers through single or continuous DNS queries. On the one hand, based on the elapsed time of the DNS response, attackers can determine whether a query for a domain name hits the cached content, thereby learning about other users' web page access behavior. On the other hand, the TTL can be used to infer the specific time when the resource record for a query entered the cache, further exacerbating the privacy risk of recursive resolver queries.

[0006] In "Timeless Timing Attacks and Preload Defenses in Tor's DNS Cache," Dahlberg et al. proposed two short-term mitigations for Tor's DNS cache timing attacks: fuzzy TTL and overlay lookup, as well as a redesign of the preload cache list. The core idea of ​​fuzzy TTL is to change the fixed cache time from the set TTL to a random value within a range with a lower bound and an upper bound. This makes it difficult for potential attackers to immediately infer the exact time when a resource record was inserted into the cache. However, this only delays the attacker's confirmation to a certain extent. Through learning and verification, the attacker can still infer the connection between user behavior and the cache. Overlay lookup, on the other hand, pre-pends some domain names to the DNS cache to create artificial false positives, making it impossible for attackers to distinguish whether cached records are caused by user activity. This method incurs a fixed cache overhead and requires frequent updates as the network changes. Furthermore, the overlay success rate is also limited, making it difficult to provide a stable solution to the timing attack problem.

[0007] The core of their work is the pre-loaded cache list method, which removes Tor's DNS cache and instead has Tor's security team create a domain name mapping list and distribute it to the routing exits. This bypasses the mechanism where query resolution results are cached, thus achieving a false positive in timing. However, this method introduces synchronization issues in its implementation: the global Tor exit list is likely to be inconsistent at the same time, leading to anomalies in resolution results. Domain name mappings are frequently updated, making it difficult to keep the list consistently up to date. Furthermore, this measure relies on the Tor environment and is not applicable to general-purpose DNS servers, making it inapplicable. Summary of the Invention

[0008] The present invention provides a DNS cache timing attack defense method based on a time obfuscation strategy, which can completely block the attacker's timing judgment in practice and prevent the attacker from obtaining any private information due to the attack.

[0009] A method for defending against DNS cache timing attacks based on a time obfuscation strategy includes the following steps: For each user message that performs a DNS query, a recorder is set to store the IP address of the queryer; After receiving the DNS query, the server checks the cached record and responds differently depending on whether the queryer's IP address has a DNS resource record. If the DNS query cache hits, it is necessary to first determine whether the queryer's IP address exists in the recorder. If the queryer's IP address exists in the recorder, a DNS response is made directly. If the queryer's IP address does not exist in the recorder, a time obfuscation strategy is implemented to add random network delays, and the queryer's IP address is stored in the recorder before a DNS response is made. If the DNS query cache does not hit, the recursive resolution process specified by the DNS protocol is carried out, and the IP address of the queryer is stored in the logger; For the recorder, the server periodically refreshes all cached IP records.

[0010] In a general DNS server scenario, the present invention addresses possible timing attack threats by adding a queryer domain tag to specific resource records cached by the server, thereby performing time obfuscation on unrecorded query messages. This eliminates the path for attackers to obtain privacy through response timing with minimal time and space overhead.

[0011] The present invention adds an additional recorder field in the cache to store the IP address of the inquirer.

[0012] Preferably, a Bloom filter is used as a recorder to reduce storage overhead without affecting the efficiency of query verification.

[0013] Compared with the standard DNS server workflow, the present invention sets the steps of recording the queryer IP and checking the existence of the queryer IP, thereby realizing user-level defense.

[0014] Furthermore, a time obfuscation strategy is implemented, specifically: A random time obfuscation mechanism is used to simulate the network delay of the recursive resolution process, so that the response time obtained by the final queryer does not reflect cache privacy.

[0015] Furthermore, in the random time obfuscation mechanism, random numbers are used to calculate the obfuscation time, and the distribution parameters can be updated in real time according to the network environment in different scenarios, thereby better simulating network delays.

[0016] The obfuscation time is calculated based on a combination of one or more random number models, using patterns such as Gaussian distribution. For example, a minimum transmission delay within a linear interval, a baseline duration of 20ms, is first set. A Gaussian distribution function is then added to this, with a mean of μ = 200ms and a standard deviation of σ = 150ms (a positive number). Assuming the final random number generated results in a variance of 1.5 standard deviations, the actual obfuscation time is calculated by adding the base delay and the variable delay: 20ms + 200ms + 225ms = 445ms.

[0017] The process of time obfuscation for a single DNS query does not affect the normal response of the server, and other DNS resolution requests can be processed in parallel. This method improves the server's work efficiency and avoids time-independent timing attacks that rely on the order of server responses.

[0018] Furthermore, all cached IP records are refreshed simultaneously, independent of the lifetime of the IP records themselves, thereby ensuring that the privacy of cached records is not leaked due to record expiration during repeated attempts by the queryer.

[0019] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention creatively adopts a dual verification system of the inquirer's IP address and domain name. The random delay added to the first-time inquirer breaks the causal relationship of "cache hit means low latency", which can effectively prevent the use of timing attacks on DNS responses.

[0020] 2. Compared with traditional defense methods, this invention solves the possibility of attackers bypassing protection through learning, artificially introducing false negatives, and can be effective for a long time. It does not need to rely on centralized management in the Tor environment, eliminating the various disadvantages of known defense methods.

[0021] 3. The present invention adopts a Bloom filter to store the inquirer IP address, which reduces the space overhead while ensuring the efficiency of DNS query and server operation, and significantly improves the overall performance of the system.

[0022] 4. The design of the present invention is independently implemented on the recursive server side and is compatible with all DNS standards, encrypted transmission protocols and client devices. It does not require modification of the stub resolver or authoritative server during deployment and does not rely on the upgrade of supporting facilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 Schematic diagram of the principle of the time obfuscation strategy in an embodiment of the present invention.

[0024] Figure 2 This is a flow chart of a method for defending against DNS cache timing attacks based on a time obfuscation strategy according to an embodiment of the present invention.

[0025] Figure 3 The response time histogram of the unprotected timing attack (0-5ms).

[0026] Figure 4 Response time histogram (global) for unprotected timing attacks.

[0027] Figure 5 The response time histogram (global) after the time obfuscation strategy of the present invention is applied. DETAILED DESCRIPTION

[0028] The present invention will be described in further detail below with reference to the accompanying drawings and examples. It should be noted that the following examples are intended to facilitate understanding of the present invention and do not have any limiting effect on the present invention.

[0029] In principle, adding time obfuscation to the DNS cache aims to invalidate attackers' inferences about cached domain names. This can be achieved by introducing false negatives. That is, even though the cache contains a message record for the corresponding domain name, the attacker's DNS query for that domain name still takes a recursive query time. This additional response time overhead is used to obfuscate the attacker's attempt, thus preventing the attacker from successfully intercepting the query. Because the server cannot distinguish whether an incoming query is from an attacker and thus delays the query, this obfuscation period applies to all incoming DNS queries.

[0030] When a user queries a domain name for the first time, the recursive resolver obtains the resolution result after the query, adds it to the cache, and responds to the user. Unlike the DNS protocol design, an additional domain needs to be added after the cached resource record to record the user's query behavior this time. The same user may request the same domain name resolution again within a short period of time. After discovering a cache hit, the server checks whether the user has used this cache record before. If it is the last queryer, it will directly respond with the cached content. If not, the query behavior is recorded in the new domain of the cache entry, and the response is delayed until the confusion time has passed.

[0031] Such an obfuscation strategy is sufficient to resist timing attacks, and the additional time delay it brings is relatively small. Suppose an attacker is trying to detect a timing attack on the DNS server. The query he sends does hit the entry in the cache, which is enough to know that other users have performed domain name resolution before, but the server will wait for the obfuscation time before responding to the resource record in the cache, which eliminates the time difference that the attacker uses to make judgments. If he initiates a test on the same domain name again, since the last resolution request has recorded the attacker's identity, another query can immediately return the cache entry. However, the attacker cannot tell whether this cached domain name has been visited by other users or is cached due to his last visit. This strategy avoids the possibility of timing attacks by recording additional differences for users. The process is as follows Figure 1 shown.

[0032] Besides the time overhead of obfuscation, adding records to cache entries also consumes additional server space. We are attempting to replace the linear IP list with a new data structure to ensure low insertion and search time and space overhead in the set. Given the uneven distribution of users querying a particular domain name, the set should be chosen to minimize space usage. Bloom filters are a viable option.

[0033] A Bloom filter is a data structure proposed by Burton Bloom in 1970. It uses a hash function to map elements into a bit array, significantly reducing storage space. A Bloom filter's capacity does not scale. Elements are hashed, and the resulting bits are added to the bit array. If all bits in the resulting hash are 1, the element is likely in the set; if any bits are 0, it is definitely not. As elements are added, more and more bits in the bit array are set to 1, increasing the likelihood of false positives. The core principle of its design is to sacrifice some accuracy for space requirements while maintaining constant insertion and query efficiency. After determining the estimated number of users and an acceptable false positive rate, the appropriate length of the bit array can be calculated, effectively reducing storage space. Based on this, a configured Bloom filter can be added to the cache, storing a hash mapping of the queryer's IP address after the resource record. If the hash result of a subsequent query for the same domain matches a bit in the filter, the user is considered to have accessed the domain and the resource record is immediately returned. Otherwise, the resource record is obfuscated.

[0034] Finally, the workflow of the present invention is as follows Figure 2 As shown. To verify the effectiveness of the present invention, a recursive resolver with caching function and related test data were used, and run in the form of a Python script on a device using an 11th Gen Intel(R)Core(TM) i7-1165G7 @ 2.80 GHz processor and 40GB DDR4 memory. After running the server, a DNS query was sent to it through the test script, and a DNS response was constructed based on the recursive resolution result or the records already in the cache and sent back to the test terminal. Finally, the response time measured by an attacker with limited capabilities was simulated to demonstrate the present invention's ability to defend against DNS cache timing attacks.

[0035] A total of 100 domain names are predefined, 50 of which are retained in the server cache through DNS query, and the attacker's query program is run, and the following results can be obtained: Figure 3 、 Figure 4 、 Figure 5 The response time histogram of . Figure 3 In , the query time overhead of cache hits is less than 4ms, and a total of 50 time samples meet this classification; Figure 4In the experiment, the query time overhead for cache misses was consistently over 4ms, and 50 time samples also met this classification. According to the initial hypothesis of the experiment, this circumstance could be used to determine whether the queried domain name was in the cache. Comparison with the initial domain name list ultimately confirmed that the results were consistent with expectations, demonstrating the threat of this attack method. The conclusion is that by sending DNS queries to the server and observing the response time, an attacker can determine with near-perfect accuracy whether a domain name exists in the server cache, and this process does not require any privileges or information beyond those of a normal user.

[0036] The server designed by the present invention can successfully defend against the same timing attack. A list of 100 domain names is still predefined, 50 of which are retained in the server cache through DNS query, and the attacker's query program is run. The domain name entries retained in the cache here are generated by another sender and are different from the attacker's IP address, so the assumption is valid. Figure 5 In this data, there are 50 samples of query time overhead for cache hits and 50 samples for cache misses. Because the attacker included their own IP address in the DNS query message, which differs from the IP address in the queryer's domain record when the cache entry was initially placed, the time obfuscation mechanism was triggered. The total time overhead for cache hits includes internal latency, server communication overhead, and random delays; the total time overhead for cache misses includes internal latency, server communication overhead, and recursive query time. Domain name query times are evenly distributed regardless of cache hit or miss. For a similar analysis, assuming the attacker selects the median response time of 442.0144ms for these 100 DNS queries and classifies based on this, the accuracy is only 48%, similar to the 50% success rate of random classification. This demonstrates that the time obfuscation method has successfully blocked this cache privacy inference method based on timing.

[0037] If the attacker attempts to query again, because their IP address has already entered the Bloom filter of the resource record entry in the cache, they can respond directly in a shorter time without delay or obfuscation, which is significantly different from a cache hit or miss. However, this cannot be used to steal cached private information because the attacker has already queried the same domain name. The time difference this time cannot determine whether the cached content was caused by other user behavior or introduced by the attacker's own timing attack behavior, thus protecting user privacy and proving the feasibility of the present invention.

[0038] The embodiments described above provide a detailed description of the technical solutions and beneficial effects of the present invention. It should be understood that the above are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, supplements and equivalent substitutions made within the scope of the principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A DNS cache timing attack defense method based on time obfuscation strategy, characterized in that: The following steps are involved: For each user message that performs a DNS query, a recorder is set to store the IP address of the queryer; After receiving the DNS query, the server checks the cached record and responds differently depending on whether the queryer's IP address is in the recorder; If the DNS query cache hits, it is necessary to first determine whether the queryer's IP exists in the logger; If the queryer's IP exists in the logger, a direct DNS response is made; If the queryer's IP address does not exist in the logger, a time obfuscation strategy is implemented to add random network delays, the queryer's IP address is stored in the logger, and then a DNS response is made; If the DNS query cache does not hit, the recursive resolution process specified by the DNS protocol is carried out, and the IP address of the queryer is stored in the logger; For the recorder, the server periodically refreshes all cached IP records.

2. The DNS cache timing attack defense method based on time obfuscation strategy according to claim 1 is characterized in that: Add an extra recorder field to the cache to store the IP address of the queryer.

3. The DNS cache timing attack defense method based on time obfuscation strategy according to claim 1 is characterized in that: The recorder uses Bloom filters to reduce storage overhead without affecting the efficiency of query verification.

4. The method for defending against DNS cache timing attacks based on a time obfuscation strategy according to claim 1, wherein: Implement a time obfuscation strategy, specifically including: using random time obfuscation to simulate possible network delays in the recursive resolution process, so that the response time obtained by the final queryer does not reflect cache privacy.

5. The DNS cache timing attack defense method based on time obfuscation strategy according to claim 1 is characterized in that: In the random time confusion mechanism, random numbers are used to calculate the confusion time.

6. The method for defending against DNS cache timing attacks based on a time obfuscation strategy according to claim 1, wherein: The random number is based on a Gaussian distribution pattern, and one or more random numbers are combined to calculate the obfuscation time.

7. The method for defending against DNS cache timing attacks based on a time obfuscation strategy according to claim 1, wherein: The process of a single DNS query entering time obfuscation does not affect the normal response of the server, and other DNS resolution requests can be processed in parallel.

8. The method for defending against DNS cache timing attacks based on a time obfuscation strategy according to claim 1, wherein: All cached IP records are refreshed simultaneously, independent of the lifetime of the IP record itself, thus ensuring that the privacy of cached records is not leaked due to record expiration during repeated attempts by the queryer.

Images