DNS Query Nonce Labeling for Spoofing Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The open and distributed architecture of the Domain Name System (DNS) makes it susceptible to hacking attacks, particularly 'spoofing' where attackers redirect users to malicious websites by flooding recursive DNS resolvers with invalid records, and existing solutions for preventing such attacks are incomplete as nonce labels can only be prepended to queries resulting in referrals, not to authoritative servers.
Innovation Solution
A method and system that determine whether to prepend nonce labels to DNS queries by evaluating DNS resolver logs for past and recent queries, flagging domain names as appropriate or inappropriate for nonce label prepending based on response types and time durations, using a processor and nonce label analyzer module to assess whether a domain name exists or not, and adjusting queries accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If nonce labels are prepended to DNS queries, then security against spoofing attacks is improved, but device complexity and operational complexity increase due to log evaluation and query modification requirements
Solution Approach 1:
The system performs preliminary actions by evaluating DNS resolver logs before sending queries to determine which queries should have nonce labels prepended. This advance preparation allows the system to identify patterns of legitimate queries and pre-determine nonce label requirements, reducing operational complexity during actual query processing while maintaining security improvements
Solution Approach 2:
The patent introduces an intermediary component that acts as a mediator between the DNS resolver and authoritative name servers. This intermediary evaluates logs, determines nonce label requirements, and modifies queries accordingly, isolating the complexity of security operations from both the resolver and name servers while maintaining the security benefits
2Reliability
If nonce labels are prepended to all DNS queries, then security coverage is improved, but productivity decreases due to unnecessary processing of queries that do not require protection
Solution Approach 1:
The system applies local quality by making nonce label prepending selective rather than universal. By evaluating logs and identifying specific queries that require protection based on their characteristics and response types, the system applies security measures only where needed, improving security coverage while avoiding unnecessary processing of queries that do not require protection
Solution Approach 2:
The patent implements partial action by applying nonce label prepending only to the specific subset of queries that require protection, rather than to all queries. This selective approach ensures adequate security coverage for vulnerable queries while avoiding the productivity loss that would result from processing all queries with the same level of protection
Data Source
AI summary
A method for prepending nonce labels to DNS queries includes determining whether a log contains a past entry of a domain name resolution query (“query”) to a name server for a full domain name that resulted in a positive reply indicating that the full domain name exists. It is determined whether the log contains a recent entry of the query that resulted in a negative reply indicating that the full domain name did not exist. The server is then queried with a nonce-less query for the full domain name. The server is queried again with a nonce label prepended query for the full domain name to determine if it currently results in the negative reply. The full domain name is flagged as inappropriate for nonce prepending upon determination that querying with a nonce prepended query results in a negative reply and a nonce-less query results in a positive reply.