DNS Server Certification Detection for Preserving ISP Services
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of public DNS servers leads to the loss of services offered by Internet service providers, such as parental control, increased international IP traffic, and potential data security breaches, due to the unencrypted nature of DNS messages and the reliance on uncertified DNS servers.
Innovation Solution
A method and device for detecting the use of uncertified DNS servers by verifying DNS resolutions against a list of certified servers, providing notifications to users or service providers, and optionally filtering or redirecting requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If public DNS servers are used, then DNS resolution speed and security (encryption) are improved, but loss of ISP services (parental control, etc.) and increase in international IP traffic occur
Solution Approach 1:
The patent introduces a gateway device as an intermediary between the terminal and public DNS servers. The gateway intercepts DNS requests, verifies whether they are directed to certified DNS servers, and can redirect uncertified requests to certified ones. This intermediary mechanism allows the system to maintain the security benefits of encrypted DNS while preventing the loss of ISP services by controlling which DNS servers are actually used.
2Speed
If public DNS servers are used, then DNS resolution speed is improved, but increase in international IP traffic and energy consumption occur
Solution Approach 1:
The gateway acts as an intermediary that localizes DNS resolution by redirecting requests to certified DNS servers, preferably located in the same country as the terminal. This reduces international IP traffic and associated energy consumption while maintaining the speed benefits of DNS caching and optimized resolution paths.
3Reliability
If public DNS servers are used, then encryption of DNS requests is improved, but data security breaches by malicious parties occur
Solution Approach 1:
The gateway serves as a trusted intermediary that inspects and controls DNS traffic. It verifies whether DNS requests are directed to certified servers and can block or redirect requests to uncertified servers, even if those requests use encryption. This intermediary control layer prevents malicious parties from exploiting encrypted DNS channels for data collection while preserving the encryption benefits for legitimate traffic.
4Measurement precision
If certification verification is implemented, then detection of uncertified DNS usage is improved, but device complexity increases
Solution Approach 1:
The patent implements preliminary action by pre-populating the gateway with a database of certified DNS server addresses before operation. This allows the gateway to quickly verify DNS requests against known certified servers without performing complex real-time analysis, thereby maintaining high detection accuracy while minimizing the complexity of the verification process during actual DNS resolution operations.
Data Source
AI summary
A method and a device for notification, by a notification device, of the use by at least one terminal of an uncertified domain name server. The method includes: receiving a request from the at least one terminal, the request comprising at least one parameter corresponding to a first address enabling communication with a server; searching for the first address in a list, the list comprising at least one address obtained from at least one certified domain name server; and notification, according to the search result, of the use by the at least one terminal of an uncertified domain name server.