DNS Resolver Prioritization for DDoS Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

DNS name servers are vulnerable to malicious attacks, such as DDoS, which overwhelm the system and make it difficult to distinguish between legitimate and malicious DNS resolution requests, leading to slowed response times or failure in handling legitimate requests.

Innovation Solution

Prioritizing DNS network traffic by identifying known DNS resolvers through historical data analysis and assigning higher priority to their requests, while dropping or delaying those from unknown resolvers during capacity overload, using a system that includes a DNS traffic prioritization service and a resolver classification module.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If DNS name servers process all DNS resolution requests equally, then the system maintains simplicity in request handling, but malicious attacks can overwhelm the server and legitimate requests cannot be distinguished from malicious ones

Engineering Contradiction:

Improveability to handle legitimate requestsVSAvoidcomplexity of request prioritization system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments DNS resolution requests into different priority levels based on resolver characteristics. Known resolvers (with static IP addresses and caching behavior) receive high priority, while unknown resolvers receive low priority. This segmentation allows the system to differentiate legitimate traffic from potential attacks without requiring complex analysis of each individual request.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary classification of DNS resolvers by analyzing their historical behavior patterns before processing requests. The system pre-identifies known resolvers based on characteristics such as static IP addresses and caching behavior, storing this information for rapid lookup during request processing. This preliminary action eliminates the need for complex real-time analysis during request handling.

Inventive Principle:

Principle #10Preliminary action

2Speed

If DNS name servers process all requests without prioritization, then the system maintains ease of operation, but response time increases during high traffic or attacks

Engineering Contradiction:

Improveresponse time for legitimate requestsVSAvoidsimplicity of request processing

Core Design Contradiction:

SpeedVSEase of operation

Solution Approach 1:

The patent segments the request processing queue into priority levels, with known resolvers placed in high-priority queues and unknown resolvers in low-priority queues. This ensures that legitimate requests from known resolvers are processed quickly even during high traffic conditions, while maintaining a simple processing mechanism through standardized queue management.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies different processing qualities to different request types. High-priority requests from known resolvers receive immediate attention with minimal processing overhead, while low-priority requests from unknown resolvers are processed after high-priority queues are cleared. This local differentiation optimizes response time for legitimate requests without complicating the overall processing framework.

Inventive Principle:

Principle #3Local quality

3Reliability

If DNS name servers accept all DNS resolution requests, then the system maintains high productivity, but malicious attacks can cause denial of service

Engineering Contradiction:

Improveresistance to denial of service attacksVSAvoidoverall request processing capacity

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies partial action by processing only a subset of requests with high priority based on resolver characteristics. Known resolvers receive preferential treatment ensuring their requests are always processed, while unknown resolvers are processed only when system capacity is available. This partial prioritization provides protection against denial of service attacks while maintaining overall system productivity.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent introduces an intermediary classification mechanism that sits between request reception and processing. This intermediary layer analyzes resolver characteristics and assigns priority levels, acting as a mediator that protects the core processing system from malicious attacks while allowing legitimate traffic to flow through efficiently. The intermediary uses simple criteria such as IP address stability and caching behavior to make classification decisions.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10541857B1Public DNS resolver prioritization

Publication Date: 2020.01.21 AMAZON TECH INC

AI summary

A technology is described for prioritizing DNS name resolutions requests received from DNS resolvers. An example method may include identifying a resolver as a public DNS resolver. Receiving a DNS name resolution request from the public DNS resolver. Assigning a priority to the DNS name resolution request received from the public DNS resolver that is lower priority as compared to a priority assigned to DNS name resolution requests received from known DNS resolvers, and providing the DNS name resolution request to the DNS name server according to the priority assigned to the DNS name resolution request.