DNS Intermediary for HTTPS Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network administrators face challenges in securely managing user access to external websites from enterprise networks, as abrupt termination of HTTPS connections frustrates users, leading them to use insecure interfaces, and installing root certificates creates security vulnerabilities.
Innovation Solution
An automated notification system that uses a web browser to render an error page explaining access denial reasons based on DNS server responses, eliminating the need for root certificate installation and reducing security risks by providing transparent policy explanations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If enterprise security devices intercept and terminate HTTPS connections to block malicious websites, then network security is improved, but user experience deteriorates due to lack of notification about access denial reasons
Solution Approach 1:
The patent introduces a DNS server as an intermediary between the user device and the blocked website. When a user attempts to access a blocked URL, the DNS server intercepts the DNS query and returns a special error code instead of the actual IP address. This intermediary mechanism allows security enforcement while providing user-friendly error messages, resolving the contradiction between security and user experience.
Solution Approach 2:
The system implements feedback by having the DNS server return specific error codes to the browser when a URL is blocked. The browser then displays these error codes to the user in a user-friendly format, providing feedback about why access was denied. This feedback loop maintains security while improving user understanding and experience.
2Reliability
If root certificates are installed on host devices to prevent certificate errors, then user security awareness is improved, but network security deteriorates due to created security vulnerabilities
Solution Approach 1:
The patent extracts the certificate validation function from the host device and relocates it to the DNS server. Instead of requiring root certificates to be installed on every user device, the DNS server performs the validation and returns appropriate error codes. This removes the harmful practice of installing root certificates while maintaining security awareness through proper error messaging.
Solution Approach 2:
The DNS server acts as an intermediary that handles certificate validation centrally, eliminating the need for local root certificate installation on host devices. This intermediary approach maintains security validation while avoiding the creation of security vulnerabilities associated with distributed root certificate installation.
3Reliability
If DNS redirection is used to redirect users to block pages, then access control is improved, but security practice deteriorates due to certificate errors requiring user clicks
Solution Approach 1:
The system performs preliminary action by validating URLs and checking against block lists during the DNS resolution phase, before the actual HTTPS connection is established. This preliminary validation prevents certificate errors from occurring in the first place, maintaining access control while avoiding the need for users to click through certificate errors.
Solution Approach 2:
The patent extracts the URL validation and blocking logic from the HTTPS connection layer and places it at the DNS resolution layer. This extraction prevents certificate errors by blocking malicious sites before SSL/TLS handshakes occur, eliminating the need for users to interact with certificate error warnings.
Data Source
AI summary
In one embodiment, a browser operating on a host device receives, from a user, a request to access a web server that includes a Uniform Resource Locator (URL) associated with the web server. In response, the browser sends, to a Domain Name System (DNS) server, a request for an Internet Protocol (IP) address correlated with the domain hosting the URL, and receives, from the DNS server, a response that comprises a block policy IP address and an appropriate error code. Based on this IP address and the error code indicated in the response, the browser renders an access denied page indicating that access to the web server associated with the URL is not permitted, wherein at least a portion of the access denied page is stored in memory accessible to the browser prior to sending the request for the IP address correlated with the domain that is hosting the URL.