Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study investigates DNS privacy enhancements specifically tailored for resource-constrained IoT devices by combining encryption with traffic obfuscation techniques. By analyzing 296 deployment scenarios, the authors demonstrate that DNS over CoAP, when optimized with equalized packet lengths and header compression, significantly reduces the accuracy of DNS traffic identification compared to traditional DNS over HTTPS. The key finding reveals that their approach can lower the identification accuracy to as low as 77%, showcasing a more effective method for protecting DNS queries in IoT environments.
Obfuscating DNS traffic can reduce identification accuracy to 77%, outperforming traditional DNS over HTTPS in protecting IoT communications.
Attackers often identify DNS traffic to disrupt or compromise Internet services. While prior work has focused on encrypting queries using DNS over TLS, HTTPS, or QUIC to counter such attacks, we consider IETF protocols designed for resource-constrained IoT devices and empirically analyze the potential of obfuscating DNS traffic in addition to encryption. We create a dataset of machine-to-machine-compatible data objects along with the corresponding DNS resolution processes, evaluating 296 deployment scenarios of resolving host names, including DNS over the Constrained Application Layer Protocol (CoAP) and an onion routing flavor of CoAP under varying link-layer conditions. We compare them to DNS over HTTPS. Using Random Forest and a header field analysis, we identify fields that leak most information. Our findings show that DNS over CoAP with equalized packet lengths, block-wise transfer, and header compression reduces the accuracy of identifying DNS frames to 86% and further to 77% with payload compression. Our approach outperforms DNS over HTTPS, where classifiers always identify DNS frames based on IP addresses. The dataset is publicly available.