DNS-Based Policy Enforcement for Encrypted Network Flows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures face challenges in enforcing policies on encrypted communication flows, as encryption obscures payload inspection, making it difficult for network devices to apply flow-specific policies without decrypting the traffic, which requires significant resources and coordination.
Innovation Solution
The technique involves mapping unique destination or source IP addresses and port numbers to communication flows, allowing enforcement devices to apply policies without decrypting the traffic, using a DNS system to generate unique addresses and store context data for policy enforcement, and an SDN controller to program network devices for flow-specific policy implementation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption protocols are used to protect communication data, then security is improved, but network devices cannot inspect payloads and apply network policy
Solution Approach 1:
The patent introduces a DNS-based intermediary system that mediates between encrypted traffic and policy enforcement needs. The DNS system receives DNS queries from clients, associates policy information with domain names, and returns policy data along with resolution information. This intermediary enables policy enforcement on encrypted traffic without requiring decryption, as the policy is attached at the DNS layer before encryption occurs.
2Ease of operation
If security devices decrypt communication flows for inspection, then policy enforcement is improved, but additional orchestration and significant compute resources are required
Solution Approach 1:
The patent extracts the policy enforcement function from the traditional decryption-inspection model. Instead of requiring security devices to decrypt traffic for policy enforcement, the system extracts policy information at the DNS layer and attaches it to domain names. This extraction eliminates the need for complex orchestration between DNS, security devices, and decryption systems, as policy is independently determined and attached without involving traffic decryption.
3Productivity
If multiple flows are multiplexed into single encrypted streams, then bandwidth efficiency is improved, but it becomes difficult to apply network policy on a per-flow basis
Solution Approach 1:
The patent segments policy enforcement from the multiplexed encrypted stream by operating at the DNS query level rather than the traffic stream level. Each DNS query can be independently processed to associate specific policy information with the corresponding application or service. This segmentation allows different policies to be applied to different flows within the same encrypted stream, as each flow's policy is determined independently at the DNS resolution stage.
Data Source
AI summary
Techniques for binding communication flows to unique addresses and/or ports, and configuring networking devices internal to a network to apply policy without the need to further introspect a given stream. Further, by creating mappings of unique addresses and/or ports to flows, the network devices are able to enforce policy without needing to coordinate with an edge node of the network at which the communication session terminates. Further, the techniques may include providing an SDN controller with a mapping between a unique address/port and a network flow, determining flow-specific policy to enforce on the flow, and programming one or more network devices to enforce the flow-specific policy in the network using the unique address/port.