DNS Blocking Server Mirroring Queries for Selective Proxy Redirection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network security systems using proxy servers only block incoming packets and do not effectively prevent information leakage or unauthorized DNS server usage, especially for outgoing packets and unauthorized DNS servers.

Innovation Solution

A network security system that includes a DNS blocking server mirroring DNS query packets, generating fake DNS response packets to redirect client terminals to a proxy server for outgoing packets and a warning server for unauthorized DNS servers, allowing selective blocking and filtering of websites and DNS servers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a proxy server is used to block incoming packets, then network security is improved, but outgoing packets and unauthorized DNS server usage are not effectively prevented

Engineering Contradiction:

Improvenetwork securityVSAvoidpacket filtering capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system divides the network security function into two separate servers: a DNS blocking server that handles DNS query packets and a proxy server that handles general packet filtering. This segmentation allows each server to specialize in specific tasks, enabling the DNS blocking server to effectively prevent unauthorized DNS server usage while the proxy server maintains its incoming packet blocking capability, thus resolving the limitation of the single-proxy-server approach

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The DNS blocking server acts as an intermediary between client terminals and DNS servers. It intercepts DNS query packets, validates them against a blocking list, and either allows or blocks them accordingly. This intermediary function enables comprehensive control over DNS traffic without requiring changes to client terminal configurations, effectively preventing information leakage through unauthorized DNS servers

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If DNS query packets are blocked to prevent information leakage, then network security is improved, but client terminal environment must be altered

Engineering Contradiction:

Improveinformation leakage preventionVSAvoidclient terminal configuration

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The DNS blocking server performs automatic validation of DNS query packets by comparing them against a pre-configured blocking list. The system self-manages the filtering process without requiring manual configuration or intervention from client terminals. Client terminals simply send DNS queries normally, and the DNS blocking server autonomously determines whether to allow or block each query based on the blocking list, eliminating the need to alter client terminal environments

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The DNS blocking server is positioned as an intermediary in the DNS resolution process. It receives DNS query packets from client terminals, processes them through automatic validation against the blocking list, and forwards approved queries to legitimate DNS servers. This intermediary approach enables security control at the network level without requiring any changes to client terminal configurations or user behaviors

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If comprehensive packet filtering is implemented, then network security is improved, but network environment complexity increases

Engineering Contradiction:

Improvepacket filtering effectivenessVSAvoidnetwork system structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The network security system is segmented into functionally distinct components: a DNS blocking server dedicated to DNS packet filtering and a proxy server for general packet control. This segmentation allows each component to be optimized for its specific function, simplifying the overall system architecture while achieving comprehensive filtering effectiveness. The clear separation of duties reduces operational complexity compared to a monolithic security system

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The DNS blocking server serves multiple functions: it blocks unauthorized DNS servers, prevents information leakage through DNS queries, and maintains a dynamic blocking list. The proxy server simultaneously handles incoming packet blocking and outgoing packet monitoring. This multi-functionality reduces the need for separate specialized systems, thereby managing network environment complexity while achieving comprehensive security

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS10320751B2DNS server selective block and DNS address modification method using proxy

Publication Date: 2019.06.11 SOOSAN INT CO LTD

AI summary

A network security system according to an embodiment may include: a DNS blocking server that is connected to network equipment to which a client terminal is connected and mirrors a DNS query packet going through the network equipment, and that generates and transmits a fake DNS response packet to the client terminal if a DNS query domain address of the DNS query packet is a domain address to be managed; and a proxy server that monitors a request packet from the client terminal generated using the fake DNS response packet.