DNS Proxy Server Malformed Request Filtering

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

DNS denial of service attacks overwhelm DNS servers with malformed requests, causing computational stress and service disruptions, which existing technologies fail to mitigate effectively.

Innovation Solution

Implementing a DNS proxy server that intercepts DNS UDP requests, determines non-matching domain names, and responds with a retry using TCP, thereby preventing the forwarding of unanswerable requests to the DNS server, thus protecting it from denial of service attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a DNS server directly processes all DNS UDP requests, then it can respond to legitimate client requests, but it becomes vulnerable to denial of service attacks from malformed requests

Engineering Contradiction:

ImproveDNS service availabilityVSAvoidcomputational stress from malformed requests

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a DNS proxy server as an intermediary between clients and the DNS server. The proxy server receives and processes DNS requests, filtering out malformed requests before they reach the DNS server. This mediator approach allows the DNS server to remain protected while still providing service through the proxy.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The DNS proxy server performs preliminary validation of DNS requests before forwarding them to the DNS server. By checking requests in advance and rejecting malformed ones upfront, the system prevents harmful requests from consuming DNS server resources, thereby maintaining service availability.

Inventive Principle:

Principle #10Preliminary action

2Productivity

If the DNS server processes every DNS request, then all legitimate requests are handled, but computational resources are exhausted during attacks

Engineering Contradiction:

ImproveDNS request processing capacityVSAvoidcomputational resource consumption

Core Design Contradiction:

ProductivityVSUse of energy by moving object

Solution Approach 1:

The DNS proxy server acts as a filter that preprocesses requests, eliminating malformed ones before they consume DNS server computational resources. This intermediary layer maintains processing capacity for legitimate requests while preventing resource exhaustion from attacks.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent extracts the request validation function from the DNS server and places it in the DNS proxy server. This separation allows the DNS server to focus on processing legitimate requests efficiently, while the proxy handles the extraction and filtering of harmful requests.

Inventive Principle:

Principle #2Taking out (Extraction)

3Measurement precision

If the DNS server spends time resolving unanswerable domain names, then it maintains accuracy in DNS resolution, but service recovery time increases after attacks

Engineering Contradiction:

ImproveDNS resolution accuracyVSAvoidservice recovery time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The DNS proxy server performs preliminary checks to identify malformed requests with unanswerable domain names before they reach the DNS server. By rejecting these requests in advance, the system maintains DNS resolution accuracy for legitimate requests while preventing time loss from processing harmful requests.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The proxy server serves as an intermediary that preserves DNS resolution accuracy by filtering requests, allowing the DNS server to maintain precise resolution for valid requests without wasting time on malformed ones, thereby reducing service recovery time.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS9756071B1DNS denial of service attack protection

Publication Date: 2017.09.05 A10 NETWORKS INC

AI summary

Exemplary embodiments for protecting a data network from a DNS denial of service attack are disclosed. The systems and methods provide for the use of a shared DNS cache between DNS UDP and DNS TCP proxy servers, to enable detection and mitigation of DNS denial of service attacks.