CPE DNS Interception for FQDN Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cybersecurity methods are hindered by the encryption of fully qualified domain names (FQDNs) in DNS traffic, making reputation checks impossible and leaving devices vulnerable to man-in-the-middle (MITM) attacks, especially with the adoption of secure encrypted DNS protocols.

Innovation Solution

The solution involves intercepting connection requests from connected devices to external encrypted DNS servers, forcing them to fallback to unencrypted DNS, and using existing service discovery mechanisms like DHCP to enforce the use of unencrypted DNS servers for filtering, thereby avoiding the need for TLS certificates and keys.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If DNS traffic is encrypted using secure encrypted DNS protocols, then user privacy is improved, but reputation check capability deteriorates

Engineering Contradiction:

Improveuser privacyVSAvoidreputation check capability

Core Design Contradiction:

Loss of informationVSMeasurement precision

Solution Approach 1:

The system segments DNS traffic handling into two paths: encrypted DNS for privacy protection and unencrypted DNS for security filtering. The CPE intercepts encrypted DNS requests and redirects them to unencrypted DNS servers, allowing reputation checks on the unencrypted path while maintaining privacy on the encrypted path.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The CPE acts as an intermediary that mediates between encrypted DNS clients and DNS servers. It intercepts encrypted DNS connection requests, forces fallback to unencrypted DNS, performs security filtering, and then allows the connection. This intermediary role enables both privacy preservation and security monitoring.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If encrypted DNS protocols are used, then protection against MITM attacks is improved, but cybersecurity filtering capability deteriorates

Engineering Contradiction:

Improveprotection against MITM attacksVSAvoidcybersecurity filtering capability

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

Instead of trying to filter encrypted DNS traffic directly, the system inverts the approach by forcing clients to use unencrypted DNS for filtering purposes. The CPE intercepts encrypted DNS requests and redirects them to unencrypted DNS servers, enabling traditional filtering methods to work while the original encrypted connection provides MITM protection.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system performs preliminary security filtering by intercepting DNS requests before they reach the final DNS server. The CPE checks the FQDN against known malicious domains and blocks suspicious requests in advance, preventing potential MITM attacks and malware communications before they can execute.

Inventive Principle:

Principle #9Preliminary anti-action

3Ease of operation

If unencrypted DNS is used for filtering, then FQDN interception capability is improved, but security against MITM attacks deteriorates

Engineering Contradiction:

ImproveFQDN interception capabilityVSAvoidsecurity against MITM attacks

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The CPE serves as a trusted intermediary that handles unencrypted DNS filtering on behalf of clients. It intercepts DNS requests, performs FQDN filtering, and returns results without exposing the filtering process to potential MITM attackers. The client's original encrypted DNS connection maintains security while the CPE's intermediary role enables filtering.

Inventive Principle:

Principle #24Intermediary (Mediator)

4Loss of information

If secure encrypted DNS servers are deployed, then privacy protection is improved, but device compatibility deteriorates

Engineering Contradiction:

Improveprivacy protectionVSAvoiddevice compatibility

Core Design Contradiction:

Loss of informationVSAdaptability or versatility

Solution Approach 1:

The CPE acts as a compatibility intermediary that translates between encrypted and unencrypted DNS protocols. It receives encrypted DNS requests from modern privacy-conscious devices, redirects them to unencrypted DNS servers for filtering, and ensures compatibility with older devices that only support unencrypted DNS, thereby maintaining broad device compatibility while preserving privacy.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS20250202912A1Cybersecurity based on domain name system protocol processing

Publication Date: 2025.06.19 CUJO LLC

AI summary

In response to intercepting, by a customer-premises equipment (CPE) a connection request from a connected device to an external encrypted domain name system (DNS) server, blocking, by the CPE, the connection request to cause the connected device to fall back to a use of an unencrypted DNS. And, in response to intercepting, by the CPE, an unencrypted DNS query from the connected device, performing, by the CPE, a cybersecurity operation related to the unencrypted DNS query.