DNS Proxy Intercepts Encrypted Sessions for Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for protecting users and devices from malware and malicious Internet content are hindered by encrypted DNS protocols, which prevent intermediary devices like routers from performing effective traffic filtering, leading to a need for systems and methods that can enforce access policies even in encrypted communication sessions.
Innovation Solution
A DNS proxy is employed on a network appliance to intercept encrypted communication sessions, determine session and client identifiers, and transmit query tracers to a security server to assess access indicators, allowing the enforcement of access policies based on client identifiers and domain names, even in encrypted DNS queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If encrypted DNS protocols are used to protect user privacy, then user privacy is improved, but traffic filtering capability deteriorates
Solution Approach 1:
The patent introduces a DNS proxy as an intermediary component positioned between the client device and the DNS server. This proxy intercepts encrypted DNS queries, extracts domain names through decryption, performs security checks against blacklists, and forwards resolved IP addresses back to the client. The proxy acts as a mediator that enables traffic filtering without requiring the client to decrypt or expose their DNS queries, thus maintaining user privacy while restoring filtering capability.
2Object-affected harmful factors
If conventional DNS-based traffic filtering is implemented, then traffic filtering capability is improved, but user privacy deteriorates
Solution Approach 1:
The DNS proxy serves as a privacy-preserving intermediary that handles encrypted DNS traffic. It decrypts queries only temporarily to perform security filtering, then re-encrypts responses before sending them to the client. This ensures that the filtering mechanism operates on encrypted traffic without exposing user privacy information to the filtering system or intermediaries.
3Reliability
If DNS queries are encrypted to prevent interception, then security is improved, but access control capability deteriorates
Solution Approach 1:
The DNS proxy functions as a security intermediary that operates on encrypted DNS traffic. It receives encrypted queries, decrypts them locally to check against security blacklists, verifies access control policies, and returns encrypted responses. This enables the system to maintain encryption for security while still performing access control filtering through the proxy's inspection capability.
Data Source
AI summary
Described systems and methods enable protecting client devices (e.g., personal computers and IoT devices) implementing encrypted DNS protocols against harmful or inappropriate Internet content. A DNS proxy intercepts an attempt to establish an encrypted communication session between a client device and a DNS server. Without decrypting any communications, some embodiments of the DNS proxy determine an identifier of the respective session and an identifier of the client device, and send a query tracer connecting the session identifier with the client identifier to a security server. In some embodiments, the security server obtains the domain name included in an encrypted DNS query from the DNS server and instructs the DNS server to allow or block access of the client device to the respective Internet domain according to a device- and/or user-specific access policy.