Verified DNS Traffic Redirection Against Pharming in LANs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing DNS server discovery mechanisms in a local area network (LAN) are insecure, leading to potential pharming attacks and interception of sensitive user data, as malicious equipment can spoof legitimate DNS servers, compromising user security and service availability.

Innovation Solution

A method for securely redirecting DNS traffic from a first name resolution server to a second name resolution server by verifying the legitimacy of the second server through a secure communication channel, using application or transport layer protocols, and managing the redirection process to ensure service continuity and security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DNS server discovery mechanisms are used in a local area network, then DNS service availability is improved, but network security deteriorates due to potential pharming attacks and malicious equipment spoofing

Engineering Contradiction:

ImproveDNS service availabilityVSAvoidnetwork security

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a first DNS server as an intermediary between the terminal and the second DNS server. This intermediary server receives DNS queries from the terminal, obtains redirection information from a authorization server, and then redirects queries to the second DNS server. This mediator approach allows secure redirection while maintaining service availability, as the intermediary verifies the legitimacy of redirection before forwarding queries.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent implements a feedback mechanism where the terminal sends test DNS queries to verify the legitimacy of the second DNS server before using it for actual DNS resolution. The terminal receives responses and determines whether to trust the second server based on this feedback. This feedback loop ensures security by allowing the terminal to detect and reject malicious servers while maintaining availability through legitimate redirection.

Inventive Principle:

Principle #23Feedback

2Duration of action of stationary object

If traffic redirection from first DNS server to second DNS server is implemented, then service continuity is improved, but authentication security deteriorates due to potential identity theft

Engineering Contradiction:

Improveservice continuityVSAvoidauthentication security

Core Design Contradiction:

Duration of action of stationary objectVSReliability

Solution Approach 1:

The patent implements preliminary verification actions before establishing DNS traffic redirection. The terminal performs test queries to the second DNS server and verifies its legitimacy before redirecting actual DNS traffic. The authorization server also performs preliminary authorization checks to ensure the second server is legitimate. This preliminary action ensures authentication security is maintained while enabling service continuity through redirection.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent applies preliminary anti-action by having the terminal actively verify the legitimacy of the second DNS server before trusting it. The terminal sends test queries and evaluates responses to prevent potential identity theft. This preemptive verification counteracts the security risk of redirection by ensuring the target server is legitimate before establishing the redirection relationship.

Inventive Principle:

Principle #9Preliminary anti-action

3Ease of operation

If DNS query redirection is enabled without verification, then ease of operation is improved, but measurement precision deteriorates due to inability to detect malicious servers

Engineering Contradiction:

ImproveDNS query processingVSAvoidserver legitimacy detection

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent enables self-service by allowing the terminal to autonomously verify the legitimacy of DNS servers through test queries. The terminal independently evaluates responses from the second DNS server and determines whether to use it, without requiring manual intervention or complex configuration. This self-service approach maintains ease of operation while improving server legitimacy detection through automated verification.

Inventive Principle:

Principle #25Self-service

Data Source

PatentEP4268426B1Methods for traffic redirection, corresponding terminal, controller, authorisation server, name resolution servers and computer program

Publication Date: 2026.04.15 ORANGE SA

Figure 1A~1C
Figure 2~3
Figure 4A~4B

AI summary

The invention relates to methods for traffic redirection, corresponding terminal, controller, authorisation server, name resolution servers and computer program. The invention relates to a name resolution method, implemented in a terminal (51) connected to a communication network, which comprises: - transmitting (511), to a first name resolution server, a name resolution message via a secure communication channel between said terminal (51) and said first name resolution server, - if a redirection of the terminal's DNS traffic is authorised, obtaining (512) at least one identifier of a second name resolution server for said redirection, - executing (513) at least one action for managing said redirection of the terminal's DNS traffic to the second name resolution server, from among at least: - checking the legitimacy of said second name resolution server, - sending an indication of a failure of a connection of the terminal with said second name resolution server, - requesting the deactivation of said redirection of DNS traffic to said second name resolution server.