# Enhancing the Privacy of Network Services through Trusted Computing
## 1 Introduction  
With the advent of the Internet and next-generation networks, traditional network services are playing a new role in emerging scenarios such as IoT (Internet of Things) and IoV (Internet of Vehicles) [1; 2; 3]. As the infrastructure of the Internet, DNS is playing more roles, including: (i) domain name resolution services; (ii) routing and load balancing for the application layers of the Internet; (iii) verification for mail servers; (iv) discovering and addressing services for digital devices [4; 5]. However, the proliferation of connected devices has led to increased opportunities for data and identity leakage due to the coverage of new embedded technologies and interconnected networking. As a fundamental and widely used Internet service, discovering and addressing services such as DNS and Multicast DNS (mDNS) have to run properly to prevent communication from collapsing. Once basic services such as DNS are attacked, the entire Internet will be affected [6; 7; 8]. These services are not only an address translation service but also provide authentication and improve security services for Internet applications. However, current services are concentrated on availability and ignore security [9; 10; 11]. The vulnerabilities of services can be exploited to attack network systems and collapse all live hosts and applications [12; 13]. When being collected by an eavesdropper with pervasive monitoring, the plaintext information carried in transactions can lead to serious threats to privacy. Attackers may lead applications to fake servers controlled by hackers and commit illegal acts such as phishing fraud and sensitive data leakage. The massive amount of data composed of various traces of Internet applications provides worthy attack targets for big data analysis technology. The machine learningalgorithm may be utilized to further analyze the application's behaviors according to logs. Data that does not involve sensitive information, such as DNS query records, may also lead to serious data leakage accidents through machine learning methods such as neural networks and feature learning [14]. Another practice challenge is that they often run in an untrusted cloud environment, such as Cloudflare and Google, so the client is not sure whether the resolved result is trusted. Cloud services turn out to be vulnerable to outside threats or privileged hypervisors [15]. Users cannot prevent servers from reserving or leaking communicated messages. Because of the complexity of applications and limitations in systems, data security based on software alone often fails [16; 17]. To address the above issues, we devise the usage of TEE [18] as an important way to enhance the security and privacy of the data and execution in network services. The basic idea is to use Intel Software Guard Extensions (SGX) [19] to implement a trusted service called DoTT (Domain service over Trusted Transport Layer Security). DoTT establishes a trusted TLS connection between the addressing client and resolver, which runs in a secure container to prevent eavesdropping and snooping. We further reconstruct the build process of the resolver application to make it run on both the TEE and normal environments for backward compatibility. The contributions of our paper are listed as follows:  
1. To enhance the security of DNS, we design a privacy-preserving and trustworthy addressing and discovering service based on TEE technology. 2. To deal with the hardware limitations of SGX and reduce the cost of adopting the new framework, we build a novel compilation model for the widespread deployment of trusted services and the correctness of refactored code. 3. To evaluate compatibility and compare our scheme with existing improvements, we implement a prototype system using Intel SGX. Experimental results show that the proposed DoTT can effectively maintain the low latency of DNS when preserving privacy. We arrange the rest of the paper as follows. To begin with, we will provide backgrounds and related work on Internet services and TEE in Section 2.