Intermediate DNS Resolver for Selective Sensitive Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS security technologies expose sensitive information to security risks and increase network resource overhead due to the need for encryption processing on entire DNS request information, leading to high maintenance costs.
Innovation Solution
An intermediate resolver converts first DNS request information into second DNS request information that includes ciphertext sensitive information and first ciphertext marking information, allowing the authoritative DNS server to perform processing without encrypting the entire request, thus reducing network resource overhead and maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption processing is performed on the entire DNS request information, then security protection is improved, but network resource overhead increases
Solution Approach 1:
The patent segments the DNS request information into two parts: sensitive information (e.g., IP address, location) and non-sensitive information. Only the sensitive information is encrypted, while the non-sensitive information remains in plaintext. This selective encryption approach maintains security protection for critical data while significantly reducing the computational overhead associated with encrypting the entire DNS request packet.
2Reliability
If encryption processing is performed on the entire DNS request information, then security protection is improved, but device maintenance costs increase
Solution Approach 1:
By segmenting the encryption scope to only sensitive information fields, the patent reduces the computational complexity and processing time required for encryption operations. This leads to lower device resource consumption, reduced operational costs, and decreased maintenance requirements compared to encrypting the entire DNS request information.
3Measurement precision
If sensitive information is included in DNS request information, then attribution judgment accuracy is improved, but security risks increase
Solution Approach 1:
The patent applies local quality by differentiating between sensitive and non-sensitive information fields within the DNS request. Sensitive information such as IP addresses and location data are encrypted to protect against security risks, while non-sensitive information remains accessible for accurate attribution judgment. This selective approach allows the system to maintain high attribution accuracy while mitigating security risks through targeted encryption of only the necessary sensitive fields.
Data Source
AI summary
Disclosed are an information processing method, an intermediate resolver, a network device and a non-transitory computer-readable storage medium. The information processing method may include: receiving first Domain Name System (DNS) request information; obtaining, according to the first DNS request information, second DNS request information comprising ciphertext sensitive information and first ciphertext marking information for indicating the ciphertext sensitive information being ciphertext information; and sending the second DNS request information to an authoritative DNS server, so that the authoritative DNS server performs information processing according to the ciphertext sensitive information and the first ciphertext marking information.