DNS Cache Validation via Whitelist Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) is vulnerable to cache poisoning attacks, where attackers exploit the lack of authentication in DNS protocols by sending spoofed DNS messages, leading to incorrect IP address mappings being stored in DNS cache tables, diverting traffic to compromised servers and allowing malicious activities such as man-in-the-middle attacks or denial of service.
Innovation Solution
A security agent intercepts DNS resolution requests and responses to build and validate DNS cache tables, sending them to a policy manager for validation, which creates a DNS whitelist cache table to filter out invalid entries and prevent cache poisoning by comparing incoming DNS resolution mappings against validated mappings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If DNS servers use cache tables to store resolution mappings for faster response, then response speed improves, but the system becomes vulnerable to cache poisoning attacks where incorrect mappings can be injected
Solution Approach 1:
The system performs preliminary validation of DNS resolution mappings by comparing them against a whitelist of authorized IP addresses before storing them in the cache table. This preventive measure ensures that only legitimate mappings are cached, blocking malicious entries before they can poison the cache while maintaining fast response times for subsequent queries.
2Reliability
If DNS servers authenticate all incoming resolution mappings, then security improves, but the complexity of the DNS protocol increases
Solution Approach 1:
The system introduces a whitelist of authorized IP addresses as an intermediary reference against which incoming DNS resolution mappings are validated. This whitelist acts as a trusted third party that simplifies the authentication process by providing a clear criterion for accepting or rejecting mappings, avoiding the need for complex mutual authentication protocols between DNS servers.
3Productivity
If DNS cache tables store more entries to reduce queries to other DNS servers, then productivity improves, but the risk of cache poisoning increases with more stored mappings
Solution Approach 1:
The system implements a feedback mechanism where each cached DNS resolution mapping is continuously validated against the whitelist of authorized IP addresses. When a new mapping is received or the cache is updated, the system checks whether the IP address appears in the whitelist before accepting the mapping. This ongoing validation provides feedback that prevents poisoned entries from being stored, allowing the cache to maintain high capacity with secure validation.
Data Source
AI summary
In some embodiments, a method stores domain name system (DNS) resolution mappings from a domain name to an address in a first table. The DNS resolution mappings are intercepted from DNS responses being sent by a DNS server. The first table is sent to a manager for validation of the DNS resolution mappings. Then, a second table is received from the manager that contains validated DNS resolution mappings. The method intercepts a DNS response that includes a domain name to address resolution mapping from the DNS server and validates the domain name to address resolution mapping using a validated DNS resolution mapping in the second table.