John Heidemann

T-DNS: Connection-Oriented DNS to Improve Privacy and Security (abstract with poster)

TitleT-DNS: Connection-Oriented DNS to Improve Privacy and Security (abstract with poster)
Publication TypeTechnical Report
Year of Publication2016
AuthorsL. Zhu, Z. Hu, J. Heidemann, D. Wessels, A. Mankin, and N. Somaiya
Date Publishedmar
InstitutionUSC/Information Sciences Institute

DNS is the canonical protocol for connectionless UDP. Yet DNS today is challenged by eavesdropping that compromises privacy, source-address spoofing that results in denial- of-service (DoS) attacks on the server and third parties, injection attacks that exploit fragmentation, and size limitations that constrain policy and operational choices. We propose T-DNS to address these problems. It uses TCP to smoothly support large payloads and to mitigate spoofing and amplification for DoS. T-DNS uses transport-layer security (TLS) to provide privacy from users to their DNS re- solvers and optionally to authoritative servers. Expectations about DNS suggest connections will balloon client latency and overwhelm servers with state, but our evaluation shows costs are modest: end-to-end latency from TLS to the recursive resolver is only about 9% slower with UDP to the au- thoritative server, and 22% slower with TCP to the authoritative. With diverse traces we show that frequent connection reuse is possible (60–95% for stub and recursive resolvers, although half that for authoritative servers), and after connec- tion establishment, we show TCP and TLS latency is equivalent to UDP. With conservative timeouts (20 s at authoritative servers and 60 s elsewhere) and conservative estimates of connection state memory requirements, we show that server memory requirements match current hardware: a large recursive resolver may have 24k active connections requiring about 3.6 GB additional RAM. We identify the key design and implementation decisions needed to minimize overhead: query pipelining, out-of-order responses, TLS connection resumption, and plausible timeouts.

URL johnh/PAPERS/Zhu16b.html