DNS Security via Dual Nameserver Cryptographic Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The domain name system (DNS) is vulnerable to domain name hijacking attacks, where unauthorized parties can modify name server (NS) records by obtaining domain owner credentials through social engineering, redirecting network traffic to fraudulent servers for phishing or illicit activities.
Innovation Solution
Implementing a security query mechanism where a DNS server requires matching security records from both the original and new authoritative nameservers before allowing modifications to NS records, thereby preventing unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If NS records can be modified using simple credentials (passwords, secret questions), then ease of operation is improved, but security is worsened due to social engineering attacks
Solution Approach 1:
The patent introduces a cryptographic intermediary mechanism where NS record modifications require cryptographic proofs from both the old and new authoritative nameservers. This intermediary cryptographic verification layer prevents direct credential-based modifications, blocking social engineering attacks while maintaining operational capability through authorized cryptographic authentication.
Solution Approach 2:
The patent requires preliminary cryptographic setup where authoritative nameservers are pre-configured with cryptographic credentials and security records before any NS record modifications can occur. This preliminary cryptographic authentication infrastructure ensures that only pre-authorized nameservers can participate in NS record changes, preventing unauthorized modifications even if credentials are compromised.
2Reliability
If cryptographic verification from both old and new nameservers is required, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent implements a universal cryptographic verification mechanism that works across different DNS infrastructure components (registrars, registrants, authoritative nameservers). The same cryptographic proof framework is used whether the modification is initiated by a registrar or a registrant, simplifying the overall system architecture despite the added security requirements.
Solution Approach 2:
The patent incorporates feedback mechanisms where the DNS server verifies cryptographic proofs from both old and new nameservers before allowing NS record modifications. This feedback loop provides clear verification signals about whether the cryptographic authentication succeeded, helping operators understand the status of modification requests without exposing security vulnerabilities.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Various techniques for improving security of domain name records are disclosed herein. In one embodiment, a method includes receiving a request to modify a domain name record containing a first domain name server to containing a second domain name server. In response to the received request, the first and second domain name servers are individually queries for corresponding first and second security records. The method can also include receiving the first and second security records from the first and second domain name servers, respectively and determining whether to allow the domain name record to be modified based on a comparison of the first and second security records.