DNS Smart Access Agent for Blocking Untrusted DNS Addresses

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional DNS systems face issues with visibility, privacy, and security, including exposure of user activities, potential malware detection, and vulnerabilities to attacks like DNS tunneling and hijacking.

Innovation Solution

Implementing a DNS smart access agent that intercepts DNS requests and ensures all communications are routed through a trusted DNS resolver, using a local cache and monitoring outbound traffic to block unauthorized addresses, and employing secure DNS protocols to maintain control and visibility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If conventional DNS systems are used, then DNS resolution is transparent and automatic, but network visibility and security control are lost

Engineering Contradiction:

ImproveDNS resolution transparencyVSAvoidnetwork security control

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent introduces a DNS smart access agent as an intermediary component that sits between the client device and external DNS servers. This agent intercepts DNS requests, resolves them through a trusted DNS server, and only allows traffic to addresses that were resolved through the trusted resolver. This mediator approach maintains the automatic DNS resolution process while providing security control and visibility, resolving the contradiction between ease of operation and reliability.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-generated harmful factors

If DNS requests are allowed to proceed freely, then user privacy is maintained, but exposure to malicious domains increases

Engineering Contradiction:

Improveexposure to malicious domainsVSAvoiduser privacy exposure

Core Design Contradiction:

Object-generated harmful factorsVSObject-affected harmful factors

Solution Approach 1:

The patent implements preliminary anti-action by blocking DNS requests to untrusted resolvers and preventing access to addresses that were not resolved through the trusted DNS server before malicious activity can occur. The DNS smart access agent proactively identifies and blocks attempts to access untrusted addresses, counteracting the harmful effect of exposure to malicious domains while maintaining legitimate user activity.

Inventive Principle:

Principle #9Preliminary anti-action

3Productivity

If DNS tunneling attacks are allowed, then network traffic flows freely, but security vulnerabilities increase

Engineering Contradiction:

Improvenetwork traffic flowVSAvoidsecurity vulnerabilities

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent implements feedback mechanisms where the DNS smart access agent continuously monitors DNS requests and traffic flow, comparing against the list of trusted addresses resolved through the trusted DNS server. When traffic patterns indicate potential DNS tunneling or when addresses are not in the trusted list, the system provides feedback by blocking the traffic. This feedback loop maintains network traffic flow for legitimate purposes while preventing security vulnerabilities.

Inventive Principle:

Principle #23Feedback

4Reliability

If a DNS protection agent is deployed, then DNS security is improved, but device complexity increases

Engineering Contradiction:

ImproveDNS securityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements self-service by having the DNS smart access agent automatically manage DNS security functions. The agent autonomously intercepts DNS requests, queries the trusted DNS server, maintains the list of trusted addresses, and automatically blocks unauthorized traffic without requiring manual intervention. This automation reduces the operational complexity burden while maintaining improved DNS security reliability.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12483532B2Systems and methods for DNS smart access

Publication Date: 2025.11.25 OPEN TEXT CORPORATION

AI summary

Embodiments of systems and methods for DNS smart access are disclosed herein. In particular, certain embodiments include a local cache of trusted addresses resolved by a trusted DNS resolver. A DNS smart access agent monitors outbound communications from applications or processes on a client device. The DNS smart access agent blocks access to addresses that were not resolved through the trusted DNS resolver.