DNS Proxy NSEC Record Spoofing Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Denial of Service (DoS) attacks on dynamically generated Next Secure (NSEC) DNS records are challenging due to processor-intensive operations and the ease with which attackers can execute such attacks by issuing numerous requests for non-existent server names, overwhelming the name server and preventing it from responding to legitimate queries.
Innovation Solution
Forcing clients to use the Transmission Control Protocol (TCP) for DNS queries instead of the unreliable User Datagram Protocol (UDP), allowing the name server to filter or rate-limit requests and generate fictitious neighbor addresses for NSEC records only when necessary, thereby reducing processor load and preventing spoofed IP address attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the name server dynamically generates and digitally signs NSEC records for every DNS query, then DNSSEC security is maintained, but processor load becomes excessive and the server becomes vulnerable to DoS attacks
Solution Approach 1:
The system pre-generates NSEC records for all possible non-existent domain names in advance, stores them in a cache, and reuses them for subsequent queries. This eliminates the need to dynamically generate and sign NSEC records for every query, significantly reducing processor load while maintaining DNSSEC security validation capabilities
Solution Approach 2:
The system creates and caches copies of NSEC records that can be reused across multiple queries. Instead of generating unique signed records for each non-existent domain query, the system retrieves pre-generated NSEC record copies from cache, reducing cryptographic operations and processor intensive work while maintaining security
2Ease of operation
If the name server processes every DNS query including those for non-existent servers, then all queries are responded to, but the server becomes overwhelmed by DoS attacks using spoofed IP addresses
Solution Approach 1:
The system implements rate limiting that monitors and tracks the frequency of DNS queries from each source IP address. When a threshold is exceeded, the system automatically blocks or throttles further queries from that source, providing feedback control that prevents DoS attacks while allowing legitimate queries to proceed
Solution Approach 2:
The system introduces a proxy server as an intermediary between clients and the authoritative name server. The proxy handles DoS protection, rate limiting, and caching operations, filtering malicious traffic before it reaches the name server and reducing the processor load on the authoritative server while maintaining query response capabilities
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
The present disclosure is directed to the reduction of denial of service, DoS, attacks against dynamically generated next secure, NSEC, records. A domain name system, DNS, proxy (602) prevents spoofed IP addresses by forcing clients (600) to transmit DNS queries via transmission control protocol, TCP, by replying (626) to a user datagram protocol, UDP, DNS request (620) with a blank or predetermined resource record with a truncation bit set to indicate that the record is too large to fit within a single UDP packet payload. Under the DNS specification, the client must re-transmit the DNS request via TCP. Upon receipt (634) of the retransmitted request via TCP, the DNS proxy generates (640) fictitious neighbor addresses and a signed NSEC record and transmits (642) the record to the client. Accordingly, the DNS proxy need not waste resources generating and signing records for requests from spoofed IP addresses via UDP.