In this paper, we present the design, implementation, and analysis of DNS over CoAP (DoC), a new proposal for secure and privacy-friendly name resolution of constrained IoT devices. We implement different design choices of DoC in RIOT, an open-source operating system for the IoT, evaluate performance measures in a testbed, compare with DNS over UDP and DNS over DTLS, and validate our protocol design based on empirical DNS IoT data. Our findings indicate that plain DoC is on par with common DNS solutions for the constrained IoT but significantly outperforms when additional standard features of CoAP are used such as caching. With OSCORE, we can save more than 10 kBytes of code memory compared to DTLS, when a CoAP application is already present, and retain the end-to-end trust chain with intermediate proxies, while leveraging features such as group communication or encrypted en-route caching. We also discuss a compression scheme for very restricted links that reduces data by up to 70%.

翻译：本文提出了基于CoAP的DNS（DoC）的设计、实现与分析，这是一种针对受限物联网设备的安全且保护隐私的名称解析新方案。我们在物联网开源操作系统RIOT中实现了DoC的不同设计方案，在测试平台上评估了性能指标，与基于UDP的DNS和基于DTLS的DNS进行了比较，并基于经验性的物联网DNS数据验证了我们的协议设计。研究结果表明，普通DoC在受限物联网环境下与常见DNS解决方案性能相当，但若利用CoAP的额外标准功能（如缓存），则显著优于后者。当已部署CoAP应用时，采用OSCORE可比DTLS节省超过10KB的代码内存，同时保留与中间代理之间的端到端信任链，并充分利用组通信或加密路径缓存等特性。我们还讨论了适用于极受限链路的压缩方案，该方案可减少高达70%的数据传输量。