Privacy Enhanced DNS Resolver Label Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) protocol discloses excessive information about queried domain names to predecessor zones, compromising user confidentiality, as the recursive resolution process reveals the entire domain name structure to operators of higher-level zones.
Innovation Solution
Implementing a privacy-enhanced DNS query method that determines and separates domain name labels, allowing queries to proceed through predecessor zones without revealing unnecessary information, using techniques such as generating false labels to obscure the domain name, thereby minimizing confidentiality disclosures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire domain name is disclosed to predecessor zones during DNS resolution, then the resolution process can proceed correctly through the hierarchical namespace, but user confidentiality is compromised as operators of higher-level zones can observe queried domain names
Solution Approach 1:
The domain name is segmented into labels (e.g., www.example.com becomes ['www', 'example', 'com']). During resolution, only necessary labels are disclosed at each level - the TLD server receives only the TLD label, while the full domain name is reconstructed progressively through the resolution chain, preventing any single predecessor zone from observing the complete domain name.
Solution Approach 2:
Necessary information is extracted and disclosed at each resolution level while unnecessary information is withheld. Each predecessor zone receives only the minimal label information required to perform its specific function in the resolution hierarchy, rather than the entire domain name structure.
2Loss of information
If label separation and selective disclosure methods are implemented to protect privacy, then user confidentiality is enhanced, but the device complexity increases due to additional processing requirements
Solution Approach 1:
The domain name is pre-segmented into labels before the resolution process begins. This preliminary segmentation allows the resolver to systematically control what information is disclosed at each level, simplifying the overall process despite the added privacy protection requirements.
Solution Approach 2:
The resolver acts as an intermediary that manages the progressive reconstruction of the domain name. It receives responses from predecessor zones and progressively builds the complete domain name picture without any single predecessor zone having access to the full information, thereby managing complexity centrally rather than distributing it throughout the system.
Data Source
AI summary
An apparatus and a non-transitory computer-readable medium may perform a method of minimizing the disclosure of a domain name contained in a DNS query. The method may include determining a first label and a second label associated with a domain name included in a DNS query. A first nameserver may be queried for a first resource record type associated with the first label without revealing information related to the second label by removing information related to the second label from the DNS query. A response may be received from the first nameserver, and the response may include the first resource record type which directs a resolver to a second nameserver. The second nameserver may be queried for a second resource record type associated with the first label and the second label.