DNS Proxy Whitelisting Shared IP Addresses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Domain-based whitelisting in networks can lead to improper whitelisting of domains that share an IP address, resulting in unnecessary avoidance of scrutiny for traffic that should be inspected, especially in cases where multiple domains are hosted by a single IP address or content delivery network, leading to inefficiencies and potential security vulnerabilities.
Innovation Solution
Implementing a DNS security service that determines if multiple domains resolve to the same IP address and using a DNS proxy to optimize whitelisting operations by acting as a TCP proxy for HTTP(S) flows and TLS proxy for TLS 1.3 flows to shared IP addresses, ensuring increased scrutiny for such traffic, and utilizing an EDNS option to signal shared IP addresses for further inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If domain-based whitelisting is implemented to avoid inspection overhead, then network traffic processing efficiency is improved, but security scrutiny accuracy deteriorates because traffic to shared IP addresses is improperly whitelisted without inspection
Solution Approach 1:
The patent segments the whitelisting decision process into two distinct phases: (1) DNS resolution phase where the DNS proxy queries the DNS security service to determine if an IP address is shared by multiple domains, and (2) traffic inspection phase where the network device applies differential inspection policies based on the shared IP address determination. This segmentation allows efficient whitelisting for unique IP addresses while maintaining security scrutiny for shared IP addresses.
Solution Approach 2:
The patent introduces a DNS security service as an intermediary between the DNS proxy and the domain whitelisting mechanism. This intermediary service receives DNS queries, determines whether resolved IP addresses are shared by multiple domains, and provides this information to the DNS proxy. The intermediary enables accurate identification of shared IP addresses without compromising the overall efficiency of the whitelisting process.
2Reliability
If all traffic to shared IP addresses is subjected to inspection, then security scrutiny accuracy is improved, but network traffic processing efficiency deteriorates due to increased overhead
Solution Approach 1:
The patent applies local quality by implementing differential inspection policies based on the specific characteristics of each IP address. Traffic to shared IP addresses receives enhanced security scrutiny, while traffic to unique IP addresses receives standard or reduced inspection. This localized quality adjustment ensures that inspection resources are concentrated where they are most needed (shared IP addresses) while maintaining efficiency for other traffic.
Solution Approach 2:
The patent implements partial action by applying inspection only to the extent necessary - specifically, enhanced scrutiny is applied only to traffic destined for shared IP addresses, while traffic to unique IP addresses benefits from full whitelisting without additional inspection overhead. This partial application of inspection maintains security where risks exist while preserving efficiency where risks do not.
3Measurement precision
If DNS proxy queries DNS security service for every domain resolution, then accuracy of identifying shared IP addresses is improved, but query response time increases
Solution Approach 1:
The patent implements preliminary action by having the DNS security service pre-determine and cache the shared IP address status during the DNS resolution process itself. The DNS proxy queries the security service as part of the initial DNS lookup, and the resulting determination is cached for subsequent use. This preliminary determination avoids the need for repeated queries and enables fast subsequent whitelisting decisions.
Solution Approach 2:
The patent merges the DNS resolution process with the shared IP address determination process. Instead of separate sequential operations, the DNS proxy combines the domain name resolution query with a query to the DNS security service about whether the resolved IP is shared. This merging of operations reduces the total number of separate queries and responses, thereby reducing overall query response time while maintaining accuracy.
Data Source
AI summary
An optimized approach to whitelisting includes, at a domain name service server, determining whether a first domain and a second domain resolve to a same Internet Protocol (IP) address, and in response to a request from a domain name service proxy as to whether the first domain resolves to an IP address shared by another domain, notifying the domain name service proxy that the first domain resolves to an IP address shared by another domain. The method further includes the domain name service proxy receiving from the domain name service server a response that indicates that the first domain resolves to an IP address shared by another domain, and storing, in memory, the IP address and an indication that the IP address is shared by another domain. A data flow associated with a shared IP address is subjected to further scrutiny even if the IP address is on a whitelist.