DNS-DNS: DNS-based De-NAT scheme

Liran Orevi; Amir Herzberg; Haim Zlatokrilov

doi:10.1007/978-3-030-00434-7_4

DNS-DNS: DNS-based De-NAT scheme

Liran Orevi, Amir Herzberg, Haim Zlatokrilov

Department of Computer Science

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

11 Scopus citations

Abstract

Network Address Translation (NAT) routers aggregate the flows of multiple devices behind a single IP address. By doing so, NAT routers masquerade the original IP address, which is often viewed as a privacy feature, making it harder to identify the communication of individuals devices behind the NAT. De-NAT is the reverse process: Re-identifying communication flowing into and out of the NAT. De-NAT can be used for traffic management, security, and lawful surveillance. We show how DNS requests provide an effective De-NAT mechanism by observing queries to open resolver, in addition to ‘classical’ provider-based De-NAT. This new method allows de-NATing in cases where known schemes fail, e.g., in Windows 8 and 10, and by remote DNS resolvers. We analyze use cases where the suggested DNS based De-NAT is effective, suggest a De-NAT algorithm and evaluate its performance on real (anonymized) traffic. Another contribution is identifying the phenomena of drum beats, which are periodic DNS requests by popular applications and processes; these can allow long-term de-NATing, and also provide fingerprinting identifying specific devices and users. We conclude with recommendations for mitigating de-NATing.

Original language	English
Title of host publication	Cryptology and Network Security - 17th International Conference, CANS 2018, Proceedings
Editors	Panos Papadimitratos, Jan Camenisch
Publisher	Springer Verlag
Pages	69-88
Number of pages	20
ISBN (Print)	9783030004330
DOIs	https://doi.org/10.1007/978-3-030-00434-7_4
State	Published - 2018
Event	17th International Conference on Cryptology and Network Security, CANS 2018 - Naples, Italy Duration: 30 Sep 2018 → 3 Oct 2018

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	11124 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	17th International Conference on Cryptology and Network Security, CANS 2018
Country/Territory	Italy
City	Naples
Period	30/09/18 → 3/10/18

Bibliographical note

Publisher Copyright:
© Springer Nature Switzerland AG 2018.

Funding

Acknowledgements. Many thanks to Amit Klein for his helpful comments. Many thanks to Roland van Rijswijk-Deij for his support during this project. This work was supported by the Israeli ministry of Science, grant number 3-11857. Part of the data that led to this research was provided by SURFnet, the National Research and Education Network in the Netherlands, https://www.surfnet.nl/en/.

Funders	Funder number
Israeli Ministry of Science	3-11857

Access to Document

10.1007/978-3-030-00434-7_4

Cite this

Orevi, L., Herzberg, A., & Zlatokrilov, H. (2018). DNS-DNS: DNS-based De-NAT scheme. In P. Papadimitratos, & J. Camenisch (Eds.), Cryptology and Network Security - 17th International Conference, CANS 2018, Proceedings (pp. 69-88). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11124 LNCS). Springer Verlag. https://doi.org/10.1007/978-3-030-00434-7_4

Orevi, Liran ; Herzberg, Amir ; Zlatokrilov, Haim. / DNS-DNS : DNS-based De-NAT scheme. Cryptology and Network Security - 17th International Conference, CANS 2018, Proceedings. editor / Panos Papadimitratos ; Jan Camenisch. Springer Verlag, 2018. pp. 69-88 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{e57fe507042d460eb1b3c4d303acbe2b,

title = "DNS-DNS: DNS-based De-NAT scheme",

abstract = "Network Address Translation (NAT) routers aggregate the flows of multiple devices behind a single IP address. By doing so, NAT routers masquerade the original IP address, which is often viewed as a privacy feature, making it harder to identify the communication of individuals devices behind the NAT. De-NAT is the reverse process: Re-identifying communication flowing into and out of the NAT. De-NAT can be used for traffic management, security, and lawful surveillance. We show how DNS requests provide an effective De-NAT mechanism by observing queries to open resolver, in addition to {\textquoteleft}classical{\textquoteright} provider-based De-NAT. This new method allows de-NATing in cases where known schemes fail, e.g., in Windows 8 and 10, and by remote DNS resolvers. We analyze use cases where the suggested DNS based De-NAT is effective, suggest a De-NAT algorithm and evaluate its performance on real (anonymized) traffic. Another contribution is identifying the phenomena of drum beats, which are periodic DNS requests by popular applications and processes; these can allow long-term de-NATing, and also provide fingerprinting identifying specific devices and users. We conclude with recommendations for mitigating de-NATing.",

author = "Liran Orevi and Amir Herzberg and Haim Zlatokrilov",

note = "Publisher Copyright: {\textcopyright} Springer Nature Switzerland AG 2018.; 17th International Conference on Cryptology and Network Security, CANS 2018 ; Conference date: 30-09-2018 Through 03-10-2018",

year = "2018",

doi = "10.1007/978-3-030-00434-7_4",

language = "אנגלית",

isbn = "9783030004330",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Verlag",

pages = "69--88",

editor = "Panos Papadimitratos and Jan Camenisch",

booktitle = "Cryptology and Network Security - 17th International Conference, CANS 2018, Proceedings",

address = "גרמניה",

}

Orevi, L, Herzberg, A & Zlatokrilov, H 2018, DNS-DNS: DNS-based De-NAT scheme. in P Papadimitratos & J Camenisch (eds), Cryptology and Network Security - 17th International Conference, CANS 2018, Proceedings. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11124 LNCS, Springer Verlag, pp. 69-88, 17th International Conference on Cryptology and Network Security, CANS 2018, Naples, Italy, 30/09/18. https://doi.org/10.1007/978-3-030-00434-7_4

DNS-DNS: DNS-based De-NAT scheme. / Orevi, Liran; Herzberg, Amir; Zlatokrilov, Haim.
Cryptology and Network Security - 17th International Conference, CANS 2018, Proceedings. ed. / Panos Papadimitratos; Jan Camenisch. Springer Verlag, 2018. p. 69-88 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 11124 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - DNS-DNS

T2 - 17th International Conference on Cryptology and Network Security, CANS 2018

AU - Orevi, Liran

AU - Herzberg, Amir

AU - Zlatokrilov, Haim

PY - 2018

Y1 - 2018

N2 - Network Address Translation (NAT) routers aggregate the flows of multiple devices behind a single IP address. By doing so, NAT routers masquerade the original IP address, which is often viewed as a privacy feature, making it harder to identify the communication of individuals devices behind the NAT. De-NAT is the reverse process: Re-identifying communication flowing into and out of the NAT. De-NAT can be used for traffic management, security, and lawful surveillance. We show how DNS requests provide an effective De-NAT mechanism by observing queries to open resolver, in addition to ‘classical’ provider-based De-NAT. This new method allows de-NATing in cases where known schemes fail, e.g., in Windows 8 and 10, and by remote DNS resolvers. We analyze use cases where the suggested DNS based De-NAT is effective, suggest a De-NAT algorithm and evaluate its performance on real (anonymized) traffic. Another contribution is identifying the phenomena of drum beats, which are periodic DNS requests by popular applications and processes; these can allow long-term de-NATing, and also provide fingerprinting identifying specific devices and users. We conclude with recommendations for mitigating de-NATing.

AB - Network Address Translation (NAT) routers aggregate the flows of multiple devices behind a single IP address. By doing so, NAT routers masquerade the original IP address, which is often viewed as a privacy feature, making it harder to identify the communication of individuals devices behind the NAT. De-NAT is the reverse process: Re-identifying communication flowing into and out of the NAT. De-NAT can be used for traffic management, security, and lawful surveillance. We show how DNS requests provide an effective De-NAT mechanism by observing queries to open resolver, in addition to ‘classical’ provider-based De-NAT. This new method allows de-NATing in cases where known schemes fail, e.g., in Windows 8 and 10, and by remote DNS resolvers. We analyze use cases where the suggested DNS based De-NAT is effective, suggest a De-NAT algorithm and evaluate its performance on real (anonymized) traffic. Another contribution is identifying the phenomena of drum beats, which are periodic DNS requests by popular applications and processes; these can allow long-term de-NATing, and also provide fingerprinting identifying specific devices and users. We conclude with recommendations for mitigating de-NATing.

UR - http://www.scopus.com/inward/record.url?scp=85057330885&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-00434-7_4

DO - 10.1007/978-3-030-00434-7_4

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:85057330885

SN - 9783030004330

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 69

EP - 88

BT - Cryptology and Network Security - 17th International Conference, CANS 2018, Proceedings

A2 - Papadimitratos, Panos

A2 - Camenisch, Jan

PB - Springer Verlag

Y2 - 30 September 2018 through 3 October 2018

ER -

Orevi L, Herzberg A, Zlatokrilov H. DNS-DNS: DNS-based De-NAT scheme. In Papadimitratos P, Camenisch J, editors, Cryptology and Network Security - 17th International Conference, CANS 2018, Proceedings. Springer Verlag. 2018. p. 69-88. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-00434-7_4

DNS-DNS: DNS-based De-NAT scheme

Abstract

Publication series

Conference

Bibliographical note

Funding

Access to Document

Other files and links

Fingerprint

Cite this