Nothing Special   »   [go: up one dir, main page]

skip to main content
research-article
Open access

Securing Name Resolution in the IoT: DNS over CoAP

Published: 28 September 2023 Publication History

Abstract

In this paper, we present the design, implementation, and analysis of DNS over CoAP~(DoC), a new proposal for secure and privacy-friendly name resolution of constrained IoT devices. We implement different design choices of DoC in RIOT, an open-source operating system for the IoT, evaluate performance measures in a testbed, compare with DNS over UDP and DNS over DTLS, and validate our protocol design based on empirical DNS IoT data. Our findings indicate that plain DoC is on par with common DNS solutions for the constrained IoT but significantly outperforms when additional standard features of CoAP are used such as caching. With OSCORE, we can save more than 10 kBytes of code memory compared to DTLS, when a CoAP application is already present, and retain the end-to-end trust chain with intermediate proxies, while leveraging features such as group communication or encrypted en-route caching. We also discuss a compression scheme for very restricted links that reduces data by up to 70%.

References

[1]
Cedric Adjih, Emmanuel Baccelli, Eric Fleury, Gaetan Harter, Nathalie Mitton, Thomas Noel, Roger Pissard-Gibollet, Frederic Saint-Marcel, Guillaume Schreiner, Julien Vandaele, and Thomas Watteyne. 2015. FIT IoT-LAB: A large scale open experimental IoT testbed. In 2015 IEEE 2nd World Forum on Internet of Things (WF-IoT). IEEE Press, Piscataway, NJ, USA, 459--464. https://doi.org/10.1109/WF-IoT.2015.7389098A
[2]
Jose Alamos, Peter Kietzmann, Thomas C. Schmidt, and Matthias Wählisch. 2022. DSME-LoRa: Seamless Long Range Communication Between Arbitrary Nodes in the Constrained IoT. Transactions on Sensor Networks (TOSN) 18, 4 (November 2022), 1--43. https://dl.acm.org/doi/10.1145/3552432
[3]
Omar Alrawi, Chaz Lever, Manos Antonakakis, and Fabian Monrose. 2019. SoK: Security Evaluation of Home-Based IoT Deployments. In IEEE S&P 2019. 1362--1380. https://doi.org/10.1109/SP.2019.00013
[4]
Christian Amsüss and Marco Tiloca. 2023. Cacheable OSCORE. Internet-Draft -- work in progress 07. IETF. https: //datatracker.ietf.org/doc/html/draft-amsuess-core-cachable-oscore-07
[5]
Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J. Alex Halderman, Luca Invernizzi, Michalis Kallitsis, Deepak Kumar, Chaz Lever, Zane Ma, Joshua Mason, Damian Menscher, Chad Seaman, Nick Sullivan, Kurt Thomas, and Yi Zhou. 2017. Understanding the Mirai Botnet. In 26th USENIX Security Symposium (USENIX Security 17). USENIX Association, Vancouver, BC, 1093--1110.
[6]
Noah Apthorpe, Danny Yuxing Huang, Dillon Reisman, Arvind Narayanan, and Nick Feamster. 2019. Keeping the Smart Home Private with Smart(er) IoT Traffic Shaping. In Proc. on Privacy Enhancing Technologies Symposium, Vol. 2019. 128--148. Issue 3. https://doi.org/10.2478/popets-2019-0040
[7]
Emmanuel Baccelli, Cenk Gündogan, Oliver Hahm, Peter Kietzmann, Martine Lenders, Hauke Petersen, Kaspar Schleiser, Thomas C. Schmidt, and Matthias Wählisch. 2018. RIOT: an Open Source Operating System for Low-end Embedded Devices in the IoT. IEEE Internet of Things Journal 5, 6 (December 2018), 4428--4440. http://doi.org/10.1109/ JIOT.2018.2815038
[8]
Carsten Bormann. 2023. Packed CBOR. Internet-Draft -- work in progress 09. IETF. https://datatracker.ietf.org/doc/ html/draft-ietf-cbor-packed-09
[9]
C. Bormann, M. Ersue, and A. Keranen. 2014. Terminology for Constrained-Node Networks. RFC 7228. IETF. https: //doi.org/10.17487/RFC7228
[10]
C. Bormann and P. Hoffman. 2020. Concise Binary Object Representation (CBOR). RFC 8949. IETF. https://doi.org/ 10.17487/RFC8949
[11]
C. Bormann and Z. Shelby. 2016. Block-Wise Transfers in the Constrained Application Protocol (CoAP). RFC 7959. IETF. https://doi.org/10.17487/RFC7959
[12]
S. Bortzmeyer. 2016. DNS Query Name Minimisation to Improve Privacy. RFC 7816. IETF. https://doi.org/10.17487/ RFC7816
[13]
S. Cheshire and M. Krochmal. 2013. DNS-Based Service Discovery. RFC 6763. IETF. https://doi.org/10.17487/RFC6763
[14]
S. Cheshire and M. Krochmal. 2013. Multicast DNS. RFC 6762. IETF. https://doi.org/10.17487/RFC6762
[15]
RIOT OS Community. 2022. RIOT Documentation -- DNS defines. https://doc.riot-os.org/group__net__dns.html, last accessed 29-05--2023.
[16]
TTN Community. 2022. The Things Network. https://www.thethingsnetwork.org/, last accessed 04--12--2022.
[17]
Hesselman Cristian, Kaeo Merike, Chapin Lyman, Claffy Kimberly, Seiden Mark, McPherson Danny, Piscitello Dave, McConachie Andrew, April Tim, Latour Jacques, and Rasmussen Rod. 2020. The DNS in IoT: Opportunities, Risks, and Challenges. IEEE Internet Computing 24, 4 (2020), 23--32. https://doi.org/10.1109/MIC.2020.3005388
[18]
J. Dickinson, S. Dickinson, R. Bellis, A. Mankin, and D. Wessels. 2016. DNS Transport over TCP - Implementation Requirements. RFC 7766. IETF. https://doi.org/10.17487/RFC7766
[19]
Lars Eggert. 2020. Towards Securing the Internet of Things with QUIC. In Proc. of 3rd NDSS Workshop on Decentralized IoT Systems and Security (DISS) (San Diego, CA, USA). Internet Society (ISOC).
[20]
S. Farrell. 2018. Low-Power Wide Area Network (LPWAN) Overview. RFC 8376. IETF. https://doi.org/10.17487/RFC8376
[21]
O. Gimenez and I. Petrov. 2021. Static Context Header Compression and Fragmentation (SCHC) over LoRaWAN. RFC 9011. IETF. https://doi.org/10.17487/RFC9011
[22]
C. Gomez, J. Crowcroft, and M. Scharf. 2021. TCP Usage Guidance in the Internet of Things (IoT). RFC 9006. IETF. https://doi.org/10.17487/RFC9006
[23]
J. Gregorio, R. Fielding, M. Hadley, M. Nottingham, and D. Orchard. 2012. URI Template. RFC 6570. IETF. https: //doi.org/10.17487/RFC6570
[24]
Cenk Gündogan, Christian Amsüss, Thomas C. Schmidt, and Matthias Wählisch. 2020. Toward a RESTful InformationCentric Web of Things: A Deeper Look at Data Orientation in CoAP. In Proc. of 7th ACM Conference on InformationCentric Networking (ICN) (Montreal, CA). ACM, New York, 77--88. https://doi.org/10.1145/3405656.3418718
[25]
Cenk Gündogan, Christian Amsüss, Thomas C. Schmidt, and Matthias Wählisch. 2022. Content Object Security in the Internet of Things: Challenges, Prospects, and Emerging
[26]
Martin Gunnarsson, Joakim Brorsson, Francesca Palombini, Ludwig Seitz, and Marco Tiloca. 2021. Evaluating the performance of the OSCORE security protocol in constrained IoT environments. Internet of Things 13 (2021), 100333. https://doi.org/10.1016/j.iot.2020.100333
[27]
Hang Guo and John Heidemann. 2020. Detecting IoT Devices in the Internet. IEEE/ACM Transactions on Networking 28, 5 (October 2020), 2323--2336. https://doi.org/10.1109/TNET.2020.3009425
[28]
Jessica Haworth. 2019. SANS reveals the top attacks for 2019 at RSA Conference. https://portswigger.net/dailyswig/sans-reveals-the-top-attacks-for-2019-at-rsa-conference.
[29]
P. Hoffman and P. McManus. 2018. DNS Queries over HTTPS (DoH). RFC 8484. IETF. https://doi.org/10.17487/RFC8484
[30]
Austin Hounsel, Kevin Borgolte, Paul Schmitt, Jordan Holland, and Nick Feamster. 2020. Comparing the Effects of DNS, DoT, and DoH on Web Performance. In Proceedings of The Web Conference 2020 (Taipei, Taiwan) (WWW '20). ACM, New York, NY, USA, 562--572. https://doi.org/10.1145/3366423.3380139
[31]
Z. Hu, L. Zhu, J. Heidemann, A. Mankin, D. Wessels, and P. Hoffman. 2016. Specification for DNS over Transport Layer Security (TLS). RFC 7858. IETF. https://doi.org/10.17487/RFC7858
[32]
J. Hui and JP. Vasseur. 2012. The Routing Protocol for Low-Power and Lossy Networks (RPL) Option for Carrying RPL Information in Data-Plane Datagrams. RFC 6553. IETF. https://doi.org/10.17487/RFC6553
[33]
C. Huitema, S. Dickinson, and A. Mankin. 2022. DNS over Dedicated QUIC Connections. RFC 9250. IETF. https: //doi.org/10.17487/RFC9250
[34]
IEEE 802.15 Working Group. 2016. IEEE Standard for Low-Rate Wireless Networks. Technical Report IEEE Std 802.15.4?-- 2015 (Revision of IEEE Std 802.15.4--2011). IEEE, New York, NY, USA. 1--709 pages.
[35]
Burton S. Kaliski Jr. 2022. Minimized DNS Resolution: Into the Penumbra. https://ipj.dreamhosters.com/wp-content/ uploads/2023/01/253-ipj.pdf. The Internet Protocol Journal 25, 3 (Dec. 2022).
[36]
Ronny Klauck and Michael Kirsche. 2013. Enhanced DNS message compression - Optimizing mDNS/DNS-SD for the use in 6LoWPANs. In 2013 IEEE International Conference on Pervasive Computing and Communications Workshops (PERCOM Workshops). 596--601. https://doi.org/10.1109/PerComW.2013.6529565
[37]
Mike Kosek, Trinh Viet Doan, Malte Granderath, and Vaibhav Bajpai. 2022. One to Rule Them All? A First Look at DNS over QUIC. In Proc. of PAM (LNCS, Vol. 13210). Springer, Cham, 537--551. https://doi.org/10.1007/978--3-030--98785--5_24
[38]
Sam Kumar, Michael P. Andersen, Hyung-Sin Kim, and David E. Culler. 2020. Performant TCP for Low-Power Wireless Networks. In 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20). USENIX Association, Santa Clara, CA, 911--932.
[39]
Leandro Lanzieri, Peter Kietzmann, Thomas C. Schmidt, and Matthias Wählisch. 2022. Secure and Authorized Clientto-Client Communication for LwM2M. In Proc. of ACM/IEEE Int. Conf. on Information Processing in Sensor Networks (IPSN '22) (Milan). IEEE, Piscataway, NJ, USA, 158--170. https://doi.org/10.1109/IPSN54338.2022.00020
[40]
Benoît Latré, Pieter De Mil, Ingrid Moerman, Niek Van Dierdonck, Bart Dhoedt, and Piet Demeester. 2005. Maximum Throughput and Minimum Delay in IEEE 802.15.4. In Mobile Ad-hoc and Sensor Networks, Xiaohua Jia, Jie Wu, and Yanxiang He (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 866--876. https://doi.org/10.1007/11599463_84
[41]
lefty. 2019. [Dumpsterfire] DNS rebinding attacks. http://www.firemountain.net/pipermail/dumpsterfire/2019- June/000090.html.
[42]
Martine Sophie Lenders, Christian Amsüss, Cenk Gündoan, Thomas C. Schmidt, and Matthias Wählisch. 2023. DNS over CoAP (DoC). Internet-Draft -- work in progress 03. IETF. https://datatracker.ietf.org/doc/html/draft-ietf-coredns-over-coap-03
[43]
Martine Sophie Lenders, Carsten Bormann, Thomas C. Schmidt, and Matthias Wählisch. 2023. A Concise Binary Object Representation (CBOR) of DNS Messages. Internet-Draft -- work in progress 03. IETF. https://datatracker.ietf.org/doc/ html/draft-lenders-dns-cbor-03
[44]
Martine S. Lenders, Thomas C. Schmidt, and Matthias Wählisch. 2021. Fragment Forwarding in Lossy Networks. IEEE Access 9 (October 2021), 143969--143987. https://doi.org/10.1109/ACCESS.2021.3121557
[45]
LoRa Alliance. 2019. RP002--1.0.0 LoRaWANRegional Parameters. Technical Report. LoRa Alliance. https://loraalliance.org/wp-content/uploads/2019/11/rp_2--1.0.0_final_release.pdf
[46]
LoRa Alliance. 2022. LoRaWAN1.0.4 Regional Parameters. Technical Report. https://resources.lora-alliance.org/ technical-specifications/rp002--1-0--4-regional-parameters
[47]
Chaoyi Lu, Baojun Liu, Zhou Li, Shuang Hao, Haixin Duan, Mingming Zhang, Chunying Leng, Ying Liu, Zaifeng Zhang, and Jianping Wu. 2019. An End-to-End, Large-Scale Measurement of DNS-over-Encryption: How Far Have We Come?. In Proc. of ACM IMC. ACM, New York, NY, USA, 22--35. https://doi.org/10.1145/3355369.3355580
[48]
Minzhao Lyu, Hassan Habibi Gharakheili, and Vijay Sivaraman. 2022. A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques. ACM Comput. Surv. (July 2022). https://doi.org/10.1145/ 3547331
[49]
Jiarun Mao, Michael Rabinovich, and Kyle Schomp. 2022. Assessing Support for DNS-over-TCP in the Wild. In Proc. of PAM (LNCS, Vol. 13210). Springer, Cham, 487--517. https://doi.org/10.1007/978--3-030--98785--5_22
[50]
ARM Mbed. 2021. DNS Resolver - API references and tutorials | Mbed OS 6 Documentation. https://os.mbed.com/ docs/mbed-os/v6.16/apis/dns-apis.html, last accessed 29-05--2023.
[51]
D. McGrew and D. Bailey. 2012. AES-CCM Cipher Suites for Transport Layer Security (TLS). RFC 6655. IETF. https: //doi.org/10.17487/RFC6655
[52]
Microchip 2009. Low Power 2.4 GHz Transceiver for ZigBee, IEEE 802.15.4, 6LoWPAN, RF4CE, SP100, WirelessHART, and ISM Applications (AT86RF231). Microchip. https://ww1.microchip.com/downloads/en/DeviceDoc/doc8111.pdf Rev.8111C.
[53]
A. Minaburo, L. Toutain, and R. Andreasen. 2021. Static Context Header Compression (SCHC) for the Constrained Application Protocol (CoAP). RFC 8824. IETF. https://doi.org/10.17487/RFC8824
[54]
A. Minaburo, L. Toutain, C. Gomez, D. Barthel, and JC. Zuniga. 2020. SCHC: Generic Framework for Static Context Header Compression and Fragmentation. RFC 8724. IETF. https://doi.org/10.17487/RFC8724
[55]
P. Mockapetris. 1987. Domain names - implementation and specification. RFC 1035. IETF. https://doi.org/10.17487/ RFC1035
[56]
G. Montenegro, N. Kushalnagar, J. Hui, and D. Culler. 2007. Transmission of IPv6 Packets over IEEE 802.15.4 Networks. RFC 4944. IETF. https://doi.org/10.17487/RFC4944
[57]
J. Nieminen, T. Savolainen, M. Isomaki, B. Patil, Z. Shelby, and C. Gomez. 2015. IPv6 over BLUETOOTH(R) Low Energy. RFC 7668. IETF. https://doi.org/10.17487/RFC7668
[58]
Roberto Perdisci, Thomas Papastergiou, Omar Alrawi, and Manos Antonakakis. 2020. IoTFinder: Efficient Large-Scale Identification of IoT Devices via Passive DNS Traffic Analysis. In IEEE EuroS&P 2020. 474--489. https://doi.org/10.1109/ EuroSP48549.2020.00037
[59]
P. Phaal, S. Panchen, and N. McKee. 2001. InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks. RFC 3176. IETF. https://doi.org/10.17487/RFC3176
[60]
Zephyr Project. 2022. DNS Resolve -- Zephyr Project Documentation. https://docs.zephyrproject.org/3.2.0/connectivity/ networking/api/dns_resolve.html, last accessed 29-05--2023.
[61]
T. Reddy, D. Wing, and P. Patil. 2017. DNS over Datagram Transport Layer Security (DTLS). RFC 8094. IETF. https: //doi.org/10.17487/RFC8094
[62]
Jingjing Ren, Daniel J. Dubois, David Choffnes, Anna Maria Mandalari, Roman Kolcun, and Hamed Haddadi. 2019. Information Exposure for Consumer IoT Devices: A Multidimensional, Network-Informed Measurement Approach. In Proc. of the Internet Measurement Conference (IMC). ACM. https://doi.org/10.1145/3355369.3355577
[63]
E. Rescorla. 2018. The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446. IETF. https://doi.org/10.17487/ RFC8446
[64]
E. Rescorla and N. Modadugu. 2012. Datagram Transport Layer Security Version 1.2. RFC 6347. IETF. https://doi.org/ 10.17487/RFC6347
[65]
E. Rescorla, H. Tschofenig, T. Fossati, and A. Kraus. 2022. Connection Identifier for DTLS 1.2. RFC 9146. IETF. https://doi.org/10.17487/RFC9146
[66]
E. Rescorla, H. Tschofenig, and N. Modadugu. 2022. The Datagram Transport Layer Security (DTLS) Protocol Version 1.3. RFC 9147. IETF. https://doi.org/10.17487/RFC9147
[67]
Christian Rossow. 2014. Amplification Hell: Revisiting Network Protocols for DDoS Abuse. In Proc. of NDSS. Internet Society, 15 pages. https://doi.org/10.14722/ndss.2014.23233
[68]
Said Jawad Saidi, Srdjan Matic, Oliver Gasser, Georgios Smaragdakis, and Anja Feldmann. 2022. Deep Dive into the IoT Backend Ecosystem. In Proc. of the 22nd ACM SIGCOMM Conf. on Internet Measurement (IMC '22) (IMC '22). Association for Computing Machinery, New York, NY, USA, 488--503. https://doi.org/10.1145/3517745.3561431
[69]
Said Jawad Saidi, Srdjan Matic, Georgios Smaragdakis, Oliver Gasser, and Anja Feldmann. 2022. Deep Dive into the IoT Backend Ecosystem. In Proc. of the 22nd ACM Internet Measurement Conference (IMC). ACM, 488--503. https: //doi.org/10.1145/3517745.3561431
[70]
J. Schaad. 2017. CBOR Object Signing and Encryption (COSE). RFC 8152. IETF. https://doi.org/10.17487/RFC8152
[71]
Benjamin M. Schwartz, Mike Bishop, and Erik Nygren. 2023. Service binding and parameter specification via the DNS (DNS SVCB and HTTPS RRs). Internet-Draft -- work in progress 12. IETF. https://datatracker.ietf.org/doc/html/draftietf-dnsop-svcb-https-12
[72]
G. Selander, J. Mattsson, F. Palombini, and L. Seitz. 2019. Object Security for Constrained RESTful Environments (OSCORE). RFC 8613. IETF. https://doi.org/10.17487/RFC8613
[73]
Göran Selander, John Preuß Mattsson, and Francesca Palombini. 2023. Ephemeral Diffie-Hellman Over COSE (EDHOC). Internet-Draft -- work in progress 20. IETF. https://datatracker.ietf.org/doc/html/draft-ietf-lake-edhoc-20
[74]
Z. Shelby, K. Hartke, and C.
[75]
J. Snijders. 2017. Deprecation of BGP Path Attribute Values 30, 31, 129, 241, 242, and 243. RFC 8093. IETF. https: //doi.org/10.17487/RFC8093
[76]
STMicroelectronics 2018. High-density performance line ARM©-based 32-bit MCU with 256 to 512KB Flash, USB, CAN, 11 timers, 3 ADCs, 13 communication interfaces (STM32F103REY). STMicroelectronics. https://www.st.com/resource/ en/datasheet/stm32f103re.pdf DS5792 Rev 13.
[77]
Marco Tiloca, Göran Selander, Francesca Palombini, John Preuß Mattsson, and Jiye Park. 2023. Group Object Security for Constrained RESTful Environments (Group OSCORE). Internet-Draft -- work in progress 19. IETF. https: //datatracker.ietf.org/doc/html/draft-ietf-core-oscore-groupcomm-19
[78]
Theodor Ts'o. 2022. [Cryptography] Cryptographic signing of software is security theater. https://www.metzdowd.com/pipermail/cryptography/2022-December/038049.html.
[79]
P. van der Stok, C. Bormann, and A. Sehgal. 2017. PATCH and FETCH Methods for the Constrained Application Protocol (CoAP). RFC 8132. IETF. https://doi.org/10.17487/RFC8132
[80]
Liang Zhu, Zi Hu, John Heidemann, Duane Wessels, Allison Mankin, and Nikita Somaiya. 2015. Connection-Oriented DNS to Improve Privacy and Security. In Proc. of IEEE Symposium on Security and Privacy. IEEE, Piscataway, NJ, USA, 171--186. https://doi.org/10.1109/SP.2015.18

Cited By

View all
  • (2024)A Cross-Layer Survey on Secure and Low-Latency Communications in Next-Generation IoTIEEE Transactions on Network and Service Management10.1109/TNSM.2024.339054321:4(4669-4685)Online publication date: 17-Apr-2024

Recommendations

Comments

Please enable JavaScript to view thecomments powered by Disqus.

Information & Contributors

Information

Published In

cover image Proceedings of the ACM on Networking
Proceedings of the ACM on Networking  Volume 1, Issue CoNEXT2
PACMNET
September 2023
50 pages
EISSN:2834-5509
DOI:10.1145/3626244
Issue’s Table of Contents
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 28 September 2023
Published in PACMNET Volume 1, Issue CoNEXT2

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. coap
  2. dns
  3. internet of things
  4. oscore

Qualifiers

  • Research-article

Funding Sources

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)373
  • Downloads (Last 6 weeks)54
Reflects downloads up to 03 Oct 2024

Other Metrics

Citations

Cited By

View all
  • (2024)A Cross-Layer Survey on Secure and Low-Latency Communications in Next-Generation IoTIEEE Transactions on Network and Service Management10.1109/TNSM.2024.339054321:4(4669-4685)Online publication date: 17-Apr-2024

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

Get Access

Login options

Full Access

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media