DNS Resolver Transaction Identifier Generation Using Cryptographic Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DNS attacks can compromise user intent by allowing malicious attackers to intercept and redirect DNS queries, leading to potential identity or data theft, as attackers can respond to DNS resolver requests before the real name server, causing users to be directed to unintended clients or resources.
Innovation Solution
The implementation of a cryptographic hash function in DNS resolvers to generate transaction identifiers for DNS queries, incorporating a predetermined random number, the destination IP address, and domain name, with optional inclusion of port numbers and domain name portions, to create unique identifiers for each query, thereby preventing attackers from predicting or intercepting queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional DNS query transaction identifiers are used, then DNS queries can be processed efficiently, but attackers can predict and intercept queries leading to DNS spoofing attacks
Solution Approach 1:
The patent replaces the traditional mechanical/random number generation method for creating transaction identifiers with a cryptographic hash function-based system. This substitution transforms the identifier generation from a simple random process into a secure cryptographic process that incorporates multiple input parameters (source/destination IP addresses, port numbers, domain name) to produce unpredictable yet consistent transaction identifiers, thereby enhancing security without significantly increasing system complexity
Solution Approach 2:
The patent creates a composite transaction identifier by combining multiple different input elements (source IP address, destination IP address, source port, destination port, domain name) through a cryptographic hash function. This composite approach ensures that the resulting transaction identifier reflects the complete query context, making it extremely difficult for attackers to predict or spoof queries while maintaining the ability to match responses to their corresponding requests
2Reliability
If transaction identifiers are made unique for each query to prevent prediction, then security is improved, but query processing efficiency may be reduced
Solution Approach 1:
The patent implements preliminary action by pre-computing the cryptographic hash function inputs from available query parameters (source/destination IP addresses, port numbers, domain name) before the actual DNS query is sent. This allows the transaction identifier to be generated in advance as part of the query preparation process, minimizing any potential delay during actual query execution and response matching
Solution Approach 2:
The patent changes the parameters used in transaction identifier generation from simple random numbers to a composite set including source/destination IP addresses, port numbers, and domain name. These parameter changes enable the creation of highly unique and secure identifiers that are specific to each query context, improving security while the efficient hashing of these parameters maintains processing speed
Data Source
AI summary
The present solution provides systems and methods for generating DNS queries that are more resistant to being compromised by attackers. To generate the transaction identifier, the DNS resolver uses a cryptographic hash function. The inputs to the hash function may include a predetermined random number, the destination IP address of the name server to be queried, and the domain name to be queried. Because of the inclusion of the name server's IP address in the formula, queries for the same domain name to different name servers may have different transaction identifiers, preventing an attacker from observing a query and predicting the identifiers for other queries. Additional entropy may be provided for generating transaction identifiers by including the port number of the name server and/or a portion of the domain name as inputs to the hash function. If it is determined that the responding server may preserve capitalization in its responses, the upper and lower case characters may be salted within the domain name to provide additional entropy in generating transaction identifiers.