# Enhancing the Privacy of Network Services through Trusted Computing
## 2 Backgrounds and Related Work
### The Addressing and Discovering Service
Hence, they are difficult to be adopted by network operators. The use of secured protocols comes with problems, including compromising conventional network architectures. For example, 10 years after DNSSEC was put forward, it has not been deployed on a large scale. The deployment of DNSSEC is only 3% of the total in the second-level domain [12]. DNSSEC [20] is the earliest DNS security protocol to reduce the risk of a man-in-the-middle attack and ensure the integrity of DNS data by issued certificates. Since DNS has not considered the security mechanism in the domain name resolution, the extension gives resolvers the ability to perform authentication and data integrity checks on the replies. The root service of the Internet domain name started to deploy the DNSSEC service in 2010, which marked the development of the domain name service to the security service. Full deployment of DNSSEC ensures that the end-user connects to the actual website or another service that corresponds to a specific domain name. However, we have to deploy this technology at every step of the lookup, from the root servers to the final authoritative servers. Hence, its current usage is still low. Moreover, DNSSEC simply verifies that the \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Scheme** & **Privacy** & **Authentication** & **Performance** & **Deployability** \\ \hline Plain DNS & ✗ & ✗ & ✓ & ✓ \\ DNSSEC & ✗ & ✓ & ✗ & ✓ \\ DNSCrypt/DNSCurve & ✓ & ✓ & ✗ & ✓ \\ ConfidentialDNS & ✓ & ✓ & ✗ & ✗ \\ DNS-over-TLS & ✓ & ✗ & ✗ & ✓ \\ DNS-over- & ✓ & ✗ & ✗ & ✓ \\ HTIPS & ✓ & ✗ & ✗ & ✓ \\ DoTT (Our) & ✓ & ✓ & ✗ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Feature comparisons among previous DNS schemes. resolved address we are requesting is valid but does not encrypt data. The vulnerability may be exploited by hackers to collect information about users. DNSCurve [21] is another security extension of DNS based on the existing DNS architecture. It uses the more efficient elliptic curve encryption algorithm to reduce the computational cost for encryption and cryptographically authenticates all DNS responses. Encrypting DNS messages using DNSCurve does not introduce additional query latency since the server's public key is stored in NS records and sent to the client. DNSCrypt is an implementation of DNSCurve and has been deployed on OpenDNS to address privacy issues. ConfidentialDNS uses a similar DNS extension mechanism to offer privacy for the DNS protocol. It proposes a new resource record type, ENCRYPT, to transmit the public key of the DNS server to the client. However, DNSCrypt and ConfidentialDNS have not applied for inclusion in standardized documents, which limits the large-scale deployment. Unlike the traditional security extension standard, DNS-over-TLS (DoT) [22] focuses more on the encryption of DNS interaction messages. Network applications, including file transfers, web browsing, and remote desktop, rely on the TLS to securely exchange data and handle privacy authentication and integrity. The IETF Request For Comments (RFC) [22] defined a way to encrypt and transmit DNS packets using TLS. DoT is a privacy-preserving mechanism designed to address DNS spoofing and cache pollution and makes data tampering more difficult, which can defend against such attacks by encrypting messages by a secure TLS channel. DNS-over-HTTPS (DoH) [23] uses HTTPS or HTTP/2 for private connections. The use of HTTPS encryption for web servers has gained widespread acceptance. The resolving results returned by DNS servers are signed, and any misbehavior will be caught. Unlike its competitor DoT, DoH does not encrypt a single query but transmits it through an encrypted tunnel between the client and the server. Hence, we are unable to identify DNS queries from all other web traffic. Although famous web browsers, including Mozilla, have announced the support for DoH in published browsers, it will bypass child pornography and lose visibility over network traffic. The DoH makes it impossible for network operators to maintain control.