DNS-Based Encrypted Traffic Management via Domain Association
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In corporate networks, managing secure connections using wildcard SSL certificates and shared addresses complicates access control, as it is difficult to block access to specific services without inadvertently blocking others, and determining the destination of secure requests requires decryption, which is privacy-invasive and inefficient.
Innovation Solution
The method involves associating a particular address with a domain name using DNS responses, allowing network owners to identify the domain name without decrypting secure requests, enabling selective blocking and decryption of traffic based on domain names, thereby differentiating traffic without decrypting sensitive content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If wildcard SSL certificates and shared addresses are used for multiple services, then device complexity is reduced and ease of operation is improved, but access control precision deteriorates and ability to selectively block services worsens
Solution Approach 1:
The patent segments the identification of secure requests by extracting and analyzing individual domain names from SSL certificates within encrypted traffic. Instead of treating all traffic to a shared address equally, the system divides the identification process into discrete domain name components that can be individually evaluated against block lists, enabling precise service-level access control while maintaining shared infrastructure.
2Measurement precision
If all secure traffic is decrypted to determine destination, then measurement precision is improved, but loss of energy increases and productivity decreases
Solution Approach 1:
The patent extracts only the necessary identification element (domain name) from the SSL certificate within the encrypted secure request, rather than decrypting the entire traffic payload. This selective extraction obtains sufficient information for access control decisions while leaving the majority of the encrypted content intact, thereby maintaining both identification accuracy and network performance.
3Object-generated harmful factors
If all secure traffic is decrypted for monitoring, then object-generated harmful factors are reduced, but loss of energy increases and user privacy is compromised
Solution Approach 1:
The system extracts only the domain name from SSL certificates in secure requests for the purpose of security monitoring and access control. By taking out only this specific identification element rather than decrypting and analyzing all traffic content, the system achieves effective threat detection and blocking while minimizing computational energy consumption and preserving user privacy.
4Measurement precision
If domain names are extracted from SSL certificates to identify secure requests, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent replaces complex cryptographic decryption operations with a simpler text extraction and matching mechanism. Instead of using computationally intensive decryption to identify secure requests, the system substitutes this with direct extraction of domain names from SSL certificates followed by string matching against block lists, thereby achieving high identification accuracy with reduced system complexity.
Data Source
AI summary
This present disclosure generally relates to managing encrypted network traffic using Domain Name System (DNS) responses. One example includes requesting an address; receiving a response from the resolution server including one or more addresses associated with the domain name; associating with the domain name a particular address selected from the received one or more addresses; receiving a request to resolve the domain name; sending a response to the request to resolve the domain name, the sent response including the particular address associated with the domain name; receiving a secure request for a resource, the secure request directed to the particular address associated with the domain name; and determining that the secure request is directed to the domain name based on the association between the particular address and the domain name.