In this paper, we present the design, implementation, and analysis of DNS over CoAP (DoC), a new proposal for secure and privacy-friendly name resolution of constrained IoT devices. We implement different design choices of DoC in RIOT, an open-source operating system for the IoT, evaluate performance measures in a testbed, compare with DNS over UDP and DNS over DTLS, and validate our protocol design based on empirical DNS IoT data. Our findings indicate that plain DoC is on par with common DNS solutions for the constrained IoT but significantly outperforms when additional standard features of CoAP are used such as caching. With OSCORE, we can save more than 10 kBytes of code memory compared to DTLS, when a CoAP application is already present, and retain the end-to-end trust chain with intermediate proxies, while leveraging features such as group communication or encrypted en-route caching. We also discuss a compression scheme for very restricted links that reduces data by up to 70%.

翻译：本文提出并实现了DNS over CoAP（DoC）——一种面向受限物联网设备的安全隐私友好型名字解析新方案。我们在物联网开源操作系统RIOT中实现了DoC的不同设计选项，通过测试床评估性能指标，与基于UDP和DTLS的DNS方案进行对比，并基于实验性物联网DNS数据验证了协议设计。研究表明，基础DoC在受限物联网场景下与常见DNS解决方案性能相当，但当利用CoAP附加标准特性（如缓存）时，其性能显著提升。在已有CoAP应用程序的场景下，使用OSCORE相比DTLS可节省超过10KB的代码内存，同时在保持与中间代理端到端信任链的基础上，支持组通信和加密路由缓存等特性。我们还针对极受限链路提出了一种压缩方案，可减少高达70%的数据传输量。