DNS Flood Protection via Intermediary Cookie Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

DNS servers are vulnerable to DNS flood attacks, which disrupt their ability to resolve domain names, leading to service outages and impacting access to various internet services.

Innovation Solution

Implementing a system where a network device, such as a Traffic Management Device (TMD), intercepts DNS requests and responds with a CNAME record containing an alias domain name and a cookie, requiring the requesting device to perform multiple DNS lookup requests, thereby validating the request and filtering out invalid or malicious traffic.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DNS servers directly process all incoming DNS requests, then DNS resolution service is provided, but DNS servers become vulnerable to flood attacks and service disruptions occur

Engineering Contradiction:

ImproveDNS service availabilityVSAvoidDNS flood attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary device positioned between DNS clients and DNS servers that intercepts DNS requests, performs validation challenges, and filters malicious traffic before it reaches the DNS server. This intermediary acts as a mediator that protects the DNS server from flood attacks while maintaining legitimate DNS resolution services.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements preliminary validation actions by requiring DNS clients to complete challenge-response protocols before their requests are forwarded to the DNS server. This preliminary action verifies the legitimacy of requests in advance, preventing malicious flood attacks from reaching the server.

Inventive Principle:

Principle #10Preliminary action

2Object-affected harmful factors

If multiple DNS lookup requests are required for validation, then malicious traffic is filtered, but additional DNS lookup requests increase network traffic and processing time

Engineering Contradiction:

ImproveMalicious traffic filteringVSAvoidDNS resolution time

Core Design Contradiction:

Object-affected harmful factorsVSLoss of time

Solution Approach 1:

The patent applies partial validation by requiring additional DNS lookup requests only from clients that fail initial validation checks or exhibit suspicious behavior patterns. Legitimate clients that pass initial checks are not subjected to the full challenge sequence, reducing the time penalty for valid requests while still filtering malicious traffic effectively.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS8886930B1DNS flood protection platform for a network

Publication Date: 2014.11.11 F5 NETWORKS INC

AI summary

Embodiments are directed towards providing protection to DNS servers against DNS flood attacks by causing a requesting device to perform multiple DNS lookup requests for resolving a resource record. A request from a network device for a resolution of a domain name may be received by a device interposed between the requesting network device and a DNS server. Upon receiving the request to resolve the domain name, the interposed device may respond with a CNAME that includes a cookie. The requesting device may then send another request that includes the cookie preceded CNAME. The interposed device may then validate the returned cookie returned in the CNAME and if valid, forward the domain name resolution request on to a DNS server. The response may then be forwarded to the requesting device.