DNS Resolver Cache for Mitigating DDoS Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current DNS systems are vulnerable to sophisticated Distributed Denial of Service (DDoS) attacks that target non-existent URLs, causing system saturation and impacting legitimate traffic, as existing caching mechanisms are insufficient to mitigate such attacks effectively.
Innovation Solution
Implementing a method where a DNS resolver stores a continuous listing of all existent domain names in a linear order, allowing it to determine if a requested domain name is existent before initiating a DNS query, thereby avoiding recursive queries for non-existent URLs and discarding resolution requests for peripheral domains during attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If DNS servers use caches to store frequently requested URLs, then performance is improved and recursive queries are reduced, but the system becomes vulnerable to sophisticated DDoS attacks targeting non-existent URLs
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing validity information for domain names before attacks occur. The system proactively determines which domain names are valid and stores this information in advance, enabling rapid validation during attacks without performing full recursive queries for non-existent domains.
Solution Approach 2:
The patent introduces an intermediary validation mechanism between the standard DNS cache and recursive queries. This intermediary layer checks domain name validity against pre-computed data before allowing recursive queries to proceed, effectively filtering out attack traffic targeting non-existent domains while preserving legitimate queries.
2Measurement precision
If DNS servers perform recursive queries for all requested URLs, then complete resolution is achieved, but system resources are exhausted during DDoS attacks
Solution Approach 1:
The patent extracts the validity verification step from the full recursive query process. By separating domain name validation from the complete resolution chain, the system can quickly reject invalid domain names without consuming the full resources of a recursive query, while still providing complete resolution for valid domains.
Solution Approach 2:
The patent applies partial action by performing only the necessary validation check rather than the complete recursive query for all requests. For invalid domain names, the system stops after validation, avoiding excessive resource consumption. For valid domain names, the full resolution process proceeds as normal.
3Reliability
If DNS caches store invalid URLs to prevent future attacks, then some protection is achieved, but finite caching space is insufficient against infinite non-existent URLs
Solution Approach 1:
The patent changes the fundamental parameter of what is being cached. Instead of caching individual invalid domain names (which would require finite space), the system caches pre-computed validity information that can validate against infinite non-existent URLs. This transforms the cache from storing specific attack targets to storing validation rules that cover all possible attacks.
Data Source
Figure 1a~1b
Figure 2a~2b
Figure 3~5
AI summary
A method of treating a DNS resolution request, the method including: - storing, in a cache memory (12) of a DNS resolver (10), a domain name database (13) storing a continuous listing of domain names, a continuous listing of domain names including every existing domain name included, in a linear order, between two endpoint domain names, - if the domain name identified in the DNS query is included, in the linear order, between the first endpoint domain name and the second endpoint domain name, searching the cache memory (12) of the DNS resolver (10) in order to determine whether the domain name identified in the DNS query matches a corresponding domain name in the cache memory of the DNS resolver (10); - initiating a DNS query only if the domain name identified in the DNS query matches a corresponding domain name in the cache memory of the DNS resolver (10).