DNS Query Validation Using Tokenized Challenge Responses
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS systems are vulnerable to malicious attacks, particularly DNS-based DDoS attacks that overwhelm recursive DNS resolvers and authoritative DNS servers, making it difficult to distinguish between legitimate and malicious queries, leading to inefficient and ineffective defense mechanisms.
Innovation Solution
Implement a DNS challenge mechanism that includes a modified domain name with a unique token generated based on the source IP address, allowing validation of subsequent queries by comparing tokens, and adding legitimate IP addresses to a whitelist for direct communication with name servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a recursive DNS resolver processes all incoming queries without validation, then query processing speed is maintained, but the system becomes vulnerable to DDoS attacks and resource exhaustion
Solution Approach 1:
The patent implements preliminary validation by inserting a DNS challenge mechanism between the recursive resolver and authoritative servers. Before processing queries, the system performs token generation and validation to identify legitimate clients in advance, blocking malicious traffic before it consumes DNS server resources.
Solution Approach 2:
The patent introduces an intermediary validation layer that acts as a mediator between the recursive DNS resolver and authoritative servers. This intermediary performs token-based authentication, allowing legitimate queries to pass through while blocking malicious ones, thus protecting the DNS infrastructure without completely blocking throughput.
2Reliability
If token validation is performed for every DNS query, then spoofed IP addresses are blocked, but computational overhead increases
Solution Approach 1:
The patent applies local quality by performing token validation selectively rather than uniformly. The system validates tokens only for queries that require authentication while allowing established legitimate clients to bypass validation, thereby reducing overall computational overhead while maintaining security where needed.
Solution Approach 2:
The patent changes the parameter of validation frequency by implementing a stateful approach where clients are either validated or trusted based on their history. This reduces the computational parameter from validating every query to validating only when necessary, lowering energy consumption while maintaining security.
3Measurement precision
If all DNS queries are processed through the validation mechanism, then attack detection accuracy is improved, but query resolution time increases
Solution Approach 1:
The patent performs preliminary token validation and client classification before query processing. By identifying and trusting legitimate clients in advance, the system reduces per-query validation time while maintaining high detection accuracy for malicious traffic.
Solution Approach 2:
The patent implements periodic re-validation for trusted clients rather than continuous validation. This allows the system to maintain high detection accuracy for new or suspicious clients while reducing time overhead for established legitimate clients through periodic rather than constant validation.
4Speed
If the DNS resolver caches all query results, then response speed for repeated queries is improved, but memory consumption increases
Solution Approach 1:
The patent changes the caching parameter by implementing selective caching based on client trust status. Trusted clients receive cached responses for frequently accessed domains, while untrusted or suspicious clients do not benefit from caching. This optimizes memory utilization by caching only for beneficial cases.
Data Source
AI summary
A system and method for validating a domain name system (DNS) query using a DNS challenge. The method includes sending a response to a first source Internet protocol (IP) address, wherein the response has a modified domain name that includes a first token, the first source IP address, and an original domain name; determining receipt of a return query for the modified domain name, wherein the return query is received from a second source IP address; upon receipt of the return query, determining a second token for the return query by executing a function with respect to the first source IP address in the modified domain name; and validating the return query by comparing the first token and the determined second token, wherein the first token is extracted from the modified domain name of the return query.