DNS Intermediary Hash Filtering for Cache Poisoning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic management systems face challenges in efficiently distinguishing legitimate DNS responses from illegitimate ones, particularly during DNS cache poisoning and reflection attacks, which can lead to computational resource overload and reduced processing speeds.
Innovation Solution
The implementation of returnable properties in DNS packets, where specific values are modified to generate hash values that match constants, allowing for efficient filtering of illegitimate responses using techniques such as Bloom filters and hash functions, thereby reducing the computational burden and conserving resources for legitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional DNS packet processing methods are used, then DNS responses are processed without efficient filtering, but this leads to computational resource overload and reduced processing speeds during cache poisoning attacks
Solution Approach 1:
The patent applies preliminary action by modifying returnable values in DNS requests before they are sent to DNS servers. The intermediary server computer modifies returnable values (such as query identifiers or domain names) to generate hash values that can be used for later filtering. This preliminary modification enables efficient identification and filtering of illegitimate responses without requiring extensive computational resources during the actual response processing phase.
Solution Approach 2:
The patent introduces an intermediary server computer that acts as a mediator between client devices and DNS servers. This intermediary performs the crucial function of modifying returnable values in requests and filtering responses based on hash comparisons. By placing this intermediary layer, the system achieves efficient filtering of illegitimate DNS responses while protecting client devices from cache poisoning attacks, thereby reducing computational burden on the DNS processing system.
2Reliability
If DNS responses are thoroughly validated to prevent cache poisoning attacks, then security is improved, but processing time and computational resources increase
Solution Approach 1:
The patent replaces complex mechanical validation systems with a more efficient hash-based filtering mechanism. Instead of performing thorough validation of every DNS response field, the system uses hash values derived from modified returnable values to quickly identify legitimate responses. This substitution of validation methodology maintains security against cache poisoning attacks while significantly reducing processing time and computational resources required for response validation.
3Productivity
If returnable values are modified to generate hash values for filtering, then efficiency of illegitimate response filtering is improved, but packet processing complexity increases
Solution Approach 1:
The patent applies parameter changes by modifying specific returnable values in DNS request packets (such as query identifiers or domain name fields) to generate corresponding hash values. These parameter modifications enable efficient filtering of illegitimate responses through hash comparison. The changes are applied to specific parameters rather than the entire packet structure, maintaining filtering efficiency while limiting the increase in overall packet processing complexity to manageable levels.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Technology related to processing network packets with returnable values is disclosed. In one example, a method includes intercepting a Domain Name System (DNS) request including returnable request values in respective request packet fields. A hash function can be used to characterize or modify the intercepted returnable request values. The intercepted DNS request can be forwarded to a DNS server. A DNS response including returnable response values in respective response packet fields can be received. The returnable response values and the hash function can be used to determine whether the DNS response is legitimate. A legitimate DNS response can be forwarded to a client.