Privacy-Preserving IoT Data Inquiry Using DNS over TLS

Privacy preservation has become one of the strict security requirements in Internet services, especially in IoT-based e-health systems. This paper proposes a privacy-preserving IoT data inquiry system that uses DNS as a hierarchical and distributed infrastructure for managing and retrieving encrypted IoT data. In the proposed system, all IoT data is encrypted end-to-end with PGP between the IoT gateway and authorized clients and stored in DNS TXT records, while both registration and inquiry messages are exchanged over DoT and authenticated with TSIG or SIG(0). Moreover, the communication with IoT devices uses dedicated protocols, such as CoAP and MQTT, and the IoT data transmission uses DNS protocol only among IoT gateway, DNS servers, and end terminals that run client applications inquiring about IoT data. Consequently, the proposed system protects the confidentiality of IoT data stored on external DNS servers and transmitted over the Internet, while DoT prevents on-path eavesdroppers from reading device domain names and DNS message contents. We implemented a prototype system in a local experimental network environment, confirming that the text-based IoT data was properly encrypted before transmitting the data and that the inquiry on the end terminal could be decrypted as designed. The results show that, in the evaluated testbed, the registration path incurs substantially higher latency than the inquiry path, mainly due to PGP encryption on the shared IoT gateway VM; that inquiry latency is dominated by TXT record retrieval rather than name resolution; and that SIG(0) incurs significantly higher latency than TSIG in all evaluated inquiry configurations, whereas their performance difference is relatively small in the full registration scenario. The reported registration latencies and the CPU-based capacity estimates exclude journal-persistence overhead. An additional disk-backed experiment showed that synchronous journal writes can substantially increase registration latency.