DNS Resolver Falsified IP Encoding for Malicious Domain Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) lacks effective mechanisms to block malicious client devices from accessing harmful resources, as existing solutions do not adequately protect clients from accessing malicious domain names without compromising user privacy or security.
Innovation Solution
A DNS resolver generates and returns a falsified network address encoded with client information, redirecting the client to a redirection network where traffic is analyzed and blocked, thereby protecting the client from accessing malicious resources while maintaining privacy and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a DNS resolver directly blocks malicious domain access, then client security is improved, but client privacy is compromised due to lack of effective blocking mechanisms
Solution Approach 1:
The patent introduces a redirection network as an intermediary between the DNS resolver and the client device. The resolver returns a falsified IP address that redirects through this intermediary network, which then analyzes traffic and blocks malicious access. This intermediary layer enables security enforcement while preserving client privacy by obscuring the direct connection path.
Solution Approach 2:
The patent extracts the security analysis function from the direct DNS resolution path and places it in a separate redirection network. By separating the blocking mechanism from the standard DNS flow, the system can enforce security policies without exposing client information in the traditional DNS query-response relationship.
2Ease of operation
If the DNS resolver returns accurate network addresses, then resource accessibility is improved, but malicious resources can be accessed
Solution Approach 1:
The patent applies preliminary anti-action by proactively redirecting DNS queries for potentially malicious domains through a security analysis path before the client can access harmful resources. The falsified IP address预先 establishes a protected route that intercepts and analyzes traffic before it reaches malicious destinations, preventing harm before it occurs.
Solution Approach 2:
The patent converts the potential harm of returning falsified IP addresses (which could lead clients away from legitimate resources) into a benefit by using the redirection mechanism to filter out malicious domains. The falsification becomes a protective measure that disguises malicious traffic as legitimate redirected traffic, enabling security enforcement while maintaining normal resource access.
3Reliability
If the DNS resolver implements blocking mechanisms, then security is improved, but system complexity increases
Solution Approach 1:
The patent segments the DNS system into distinct functional components: the standard DNS resolver, the redirection network, and the traffic analysis mechanism. This segmentation allows each component to perform its specific function independently, reducing the complexity burden on any single element while achieving comprehensive security through the coordinated system.
Data Source
AI summary
Techniques are presented herein for a DNS resolver to encode a falsified IP address with a client identifier that identifies a client attempting to access a blocked domain. The DNS resolver receives, from a client, a DNS request that contains a requested domain name and a client identifier. The DNS resolver then determines the identity of the client from the client identifier in the DNS request. The DNS resolver then applies policies for the domain name system request to determine that the requested domain name should be blocked for the identity of the client. The DNS resolver may then construct a falsified Internet Protocol address when the domain name should be blocked for the identified client, where the falsified Internet Protocol is encoded with the client identifier. The DNS resolver then sends to the client, in response to the DNS request, the falsified Internet Protocol address.