DNS Cache Poisoning Prevention via Intermediary Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DNS cache poisoning attacks can compromise the accuracy of DNS server caches by replacing real IP addresses with fake ones, leading to potential security risks and user experience issues, as existing prevention methods rely heavily on configuration adjustments and encryption, which may not be universally effective.
Innovation Solution
A method and device that forward DNS query requests to a first authoritative DNS server and, upon detecting a cache poisoning attack, construct and send a second query request to a different authoritative DNS server with the same domain name-IP address mapping, generating a final reply packet only when no poisoning is detected, thereby reducing the attacker's chances of successful poisoning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNSSEC technology is used to encrypt the DNS cache, then the security against DNS cache poisoning is improved, but the device complexity and configuration requirements increase
Solution Approach 1:
The patent introduces a preventing equipment as an intermediary component between the DNS server and authoritative DNS servers. This intermediary actively monitors DNS query requests and reply packets, detecting cache poisoning attacks in real-time without requiring complex configuration changes to the DNS server itself or implementation of DNSSEC encryption mechanisms.
Solution Approach 2:
The preventing equipment autonomously performs detection and prevention functions by independently analyzing DNS packets, identifying poisoning attacks, and blocking malicious traffic. This self-service capability eliminates the need for extensive manual configuration and complex security setup that would otherwise be required on the DNS server.
2Reliability
If TCP function is enabled on the DNS server to prevent DNS cache poisoning, then the security is improved, but the device complexity and operational constraints increase
Solution Approach 1:
Rather than modifying the DNS server to enable TCP functions, the patent employs a preventing equipment intermediary that operates at the network layer to detect and block poisoning attacks. This approach maintains the simplicity of the DNS server while achieving security goals through external monitoring and intervention.
Solution Approach 2:
The patent separates the security function from the DNS server by introducing a dedicated preventing equipment component. This segmentation allows the DNS server to remain simple and unchanged while the security functions are implemented independently in the preventing equipment, avoiding the operational constraints that would result from enabling TCP on the DNS server.
3Reliability
If random source port and DNS request ID are generated for each query, then the difficulty for attackers to poison the cache is increased, but the loss of time for generating and managing these parameters increases
Solution Approach 1:
The patent implements a feedback mechanism where the preventing equipment monitors the entire DNS query process, including the random parameters generated by the DNS server. By actively tracking query requests and their corresponding replies, the system can verify the authenticity of responses and detect poisoning attempts, making the random parameter generation more effective without requiring additional time overhead for manual management.
Data Source
AI summary
The present disclosure provides a method and a device for preventing DNS cache poisoning. According to an example of the method, a preventing equipment may forward a first DNS query request packet sent by a DNS server to a first authoritative DNS server. The preventing equipment may construct a second DNS query request packet including the target domain name and send the second DNS query request packet to a second authoritative DNS server when a first DNS reply packet received for the first DNS query request packet indicates a DNS cache poisoning attack occurs. When a second DNS reply packet received for the second DNS query request packet indicates no DNS cache poisoning attack occurs, the preventing equipment may generate a final DNS reply packet according to the second DNS reply packet and feed back the final DNS reply packet to the DNS server.