DNS Resolver Nameserver Verification for Hijacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Domain hijacking during DNS lookups poses a risk as malicious nameservers can redirect users to incorrect network addresses, potentially leading to malware infections, phishing attacks, and other malicious activities.
Innovation Solution
A method and apparatus that utilize a DNS resolver to identify and prevent the use of improper nameservers by determining whether a nameserver is suspect based on predefined criteria, ensuring that only authorized nameservers resolve DNS requests, thereby preventing communication with potentially malicious servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If DNS requests are directed to any available nameserver, then DNS resolution speed is improved, but security against domain hijacking deteriorates
Solution Approach 1:
The system performs preliminary verification of nameserver legitimacy by checking domain ownership records and nameserver authorization before allowing DNS resolution. This preliminary action ensures that only authorized nameservers can resolve domain names, preventing domain hijacking while maintaining resolution speed through pre-validation caching.
Solution Approach 2:
The invention introduces an intermediary verification layer between the DNS resolver and nameserver that checks domain ownership and nameserver authorization. This intermediary mechanism validates whether a nameserver is properly authorized to resolve a domain name before allowing the resolution to proceed, thus securing against hijacking without significantly impacting speed.
2Ease of operation
If DNS requests are directed to any available nameserver, then ease of operation is improved, but susceptibility to malicious activity worsens
Solution Approach 1:
The DNS resolver performs self-verification by automatically checking domain ownership records and nameserver authorization without requiring external intervention. This self-service mechanism maintains ease of operation while protecting against malicious activity through automated validation of nameserver legitimacy.
Solution Approach 2:
The system implements feedback mechanisms where the DNS resolver continuously monitors nameserver responses and validates them against domain ownership records. This feedback loop automatically detects and blocks malicious nameservers while maintaining simple operation for legitimate DNS resolution requests.
Data Source
AI summary
The technology disclosed herein enables detection of domain hijacking when a DNS resolver is performing a DNS lookup. In a particular embodiment, a method provides receiving a DNS request from a requesting computing system. The DNS request includes a domain name for which the requesting computing system is requesting resolution of a network address associated with the domain name in the DNS. The method further provides, in response to receiving the DNS request, identifying a nameserver, via a root nameserver of the DNS, to handle the DNS request and determining the nameserver is not a proper nameserver for the domain name specifically. The proper nameserver is defined by nameserver criteria generated specifically for the domain name. The method also provides preventing the nameserver from being used to resolve the DNS request in response to determining that the nameserver is not a proper nameserver for the domain name.