Encrypted DNS Query Routing for Resolver Anonymity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) is vulnerable to security breaches and lacks privacy protection, with existing solutions like DNS over TLS and DNS over HTTPS focusing on encryption rather than user anonymity, and Oblivious DNS (ODNS) requiring additional servers.
Innovation Solution
A new OPCODE type for DNS queries is introduced, along with additional A or AAAA resource records, to encrypt queries and session keys using the public key of a final resolver, allowing communication through multiple resolvers without dedicated servers, ensuring privacy and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS queries are encrypted using existing protocols like DNS over TLS or DNS over HTTPS, then security is improved, but user anonymity and privacy are not adequately protected
Solution Approach 1:
The DNS query process is segmented into multiple independent resolution steps. Instead of a direct query from client to resolver, the system divides the resolution into chained queries through multiple resolvers, where each resolver only sees a portion of the final query target. This segmentation prevents any single resolver from obtaining complete information about the user's intent, thereby protecting anonymity while maintaining security.
Solution Approach 2:
Intermediate DNS resolvers are introduced as mediators between the client and the final authoritative resolver. These intermediaries forward encrypted queries without being able to decrypt them, acting as privacy-preserving relays. The intermediary resolvers enable the query to reach the final destination while preventing any single point from observing the complete query path and target, thus protecting user anonymity.
2Loss of information
If Oblivious DNS (ODNS) is implemented to protect user anonymity, then privacy is improved, but additional dedicated servers and infrastructure are required
Solution Approach 1:
The system enables ordinary DNS resolvers to function as privacy-protecting intermediaries without requiring specialized dedicated ODNS servers. By implementing the chaining mechanism in standard resolvers, the system achieves oblivious DNS functionality using existing infrastructure, eliminating the need for separate dedicated server deployments while maintaining user anonymity.
Solution Approach 2:
The privacy protection mechanism leverages the existing DNS resolver infrastructure to serve itself. Rather than requiring external dedicated servers, the system modifies the behavior of standard resolvers to participate in the chaining mechanism, allowing them to provide privacy protection as part of their normal operation. This self-service approach reduces infrastructure complexity while achieving the desired privacy goals.
3Loss of information
If multiple DNS resolvers are chained to protect privacy, then user anonymity is improved, but query speed may be reduced
Solution Approach 1:
The system performs preliminary actions by pre-establishing the chain of resolvers and encrypting the query path information before the actual resolution begins. The client prepares the encrypted query containing the chain of resolvers in advance, allowing intermediate resolvers to simply forward the query without performing complex decryption or processing at query time. This preliminary preparation reduces the time penalty of multi-resolver chaining.
Solution Approach 2:
The encrypted query format allows intermediate resolvers to rapidly skip through the forwarding process without stopping for decryption or analysis. By encoding the resolver chain in the query itself, each intermediate resolver can quickly identify the next hop and forward the query without delay, minimizing the cumulative time impact of multiple resolvers while maintaining anonymity protection.
Data Source
Figure 1~2
Figure 3~5
Figure 6~11
AI summary
Embodiments presented herein relates to a method for secure domain name system (DNS) queries. The method is performed in a DNS client, and the method comprises obtaining (S100) an encryption key and internet protocol, IP, address for a final DNS resolver, creating (S110) a session key, encrypting (S120) a DNS query and the created session key with the obtained encryption key, and sending (S130) a DNS message containing the encrypted DNS query and the created session key to an intermediate DNS resolver, different from the final DNS resolver, together with the obtained IP address for the final DNS resolver. Methods, nodes, computer programs, and a computer program product for secure DNS queries are also presented.