基于HTTPS的不经意PDKEEPAAA（ODoH）：对DNS的实用隐私增强
Oblivious DNS over HTTPS (ODoH): A Practical Privacy Enhancement to DNS
摘要：
域名系统（DNS）是人类可用的互联网的基础，响应客户端对具有相应IP地址和记录的主机名的查询。传统DNS也是未加密的，会将用户信息泄露给网络运营商。最近使用DNS over TLS（DoT）和DNS over HTTPS（DoH）来保护DNS的努力已经获得了越来越多的关注，表面上保护了流量并隐藏了旁观者的内容。然而，对DoT和DoH的批评之一是由于少量的大规模部署（例如，Comcast，Google，Cloudflare）：DNS解析器可以将查询内容与IP地址形式的客户端身份相关联。不经意DNS over HTTPS（ODoH）可防止此问题。在本文中，我们问什么将采取使ODoH实用？我们描述ODoH，一个实用的DNS协议，旨在解决这个问题，保护客户端的内容和身份。我们实现和部署协议，并进行测量，以表明ODoH具有与DoH和DoT等协议相当的性能，这些协议正在获得广泛采用，同时提高客户端隐私，使ODoH成为DNS使用的实用隐私增强替代品。
英文摘要：
The Domain Name System (DNS) is the foundation of a human-usable Internet, responding to client queries for host-names with corresponding IP addresses and records. Traditional DNS is also unencrypted, and leaks user information to network operators. Recent efforts to secure DNS using DNS over TLS (DoT) and DNS over HTTPS (DoH) have been gaining traction, ostensibly protecting traffic and hiding content from on-lookers. However, one of the criticisms of DoT and DoH is brought to bear by the small number of large-scale deployments (e.g., Comcast, Google, Cloudflare): DNS resolvers can associate query contents with client identities in the form of IP addresses. Oblivious DNS over HTTPS(ODoH) safeguards against this problem. In this paper we ask what it would take to make ODoH practical? We describe ODoH, a practical DNS protocol aimed at resolving this issue by both protecting the client's content and identity. We implement and deploy the protocol, and perform measurements to show that ODoH has comparable performance to protocols like DoH and DoT which are gaining widespread adoption, while improving client privacy, making ODoH a practical privacy enhancing replacement for the usage of DNS.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
