DNS Request Redirection Through Authorized Resolver Gateways
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet service providers (ISPs) face challenges in controlling domain name resolution requests when users employ secure protocols like DNS over HTTPS, leading to a loss of control over filtering and monitoring capabilities, compromising network security and privacy.
Innovation Solution
An interface device intercepts and redirects domain name resolution requests to authorized DNS servers by detecting unauthorized servers, generating alternative requests, and implementing filters to ensure compliance with ISP policies, thereby maintaining user confidentiality and security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS over HTTPS is used to encrypt domain name resolution requests, then user security and privacy are improved, but ISP control and monitoring capabilities deteriorate
Solution Approach 1:
The patent introduces a home gateway as an intermediary device between the user terminal and the DNS server. The gateway intercepts encrypted DoH requests, decrypts them using a client secret key, processes the domain name resolution through authorized DNS servers, and forwards the resolved IP addresses back to users. This intermediary approach allows ISPs to maintain control and monitoring capabilities while still supporting encrypted DNS protocols, resolving the contradiction between user security and ISP control.
2Loss of information
If DNS over HTTPS is used to prevent eavesdropping, then privacy protection is improved, but filtering and monitoring operations deteriorate
Solution Approach 1:
The patent implements preliminary action by having the home gateway intercept and decrypt DNS requests before they reach external DNS servers. The gateway extracts domain names from encrypted DoH requests, processes them through authorized DNS servers, and applies filtering rules (such as parental controls and malicious site blocking) before returning results to users. This preliminary processing enables filtering and monitoring operations to occur on encrypted traffic, maintaining both privacy protection and filtering efficiency.
3Reliability
If direct DoH requests are allowed to DNS servers, then user confidentiality is improved, but ISP ability to enforce policies deteriorates
Solution Approach 1:
The home gateway acts as a mandatory intermediary that all DNS requests must pass through. Even when users configure their devices to use DoH, the gateway intercepts these requests, decrypts them, and forwards them only to authorized DNS servers. The gateway also enforces ISP policies by blocking access to malicious sites and applying parental controls. This intermediary mechanism ensures that user confidentiality is maintained through encryption while ISP policy enforcement capabilities are preserved through centralized control at the gateway level.
Data Source
Figure 1~6
Figure 2
Figure 3
AI summary
The invention relates to a method for processing requests sent by a user terminal, carried out by an interface device allowing the user terminal to access a communication network. When a received request is detected (E2 to E5; E2' to E5') as intended for being transmitted to a server not authorised by the interface device, the processing method comprises: - receiving (E6; E6') a second request intended for being sent to a resolution server associated with said interface device among resolution servers associated with the interface device; and - transmitting (E7, E7'), to said resolution server associated with said interface device, said second request received or a third request (RR3) generated by the interface device (20) from said second request (RR2) received.