DNS Resolver Trust Verification for DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed Denial-of-Service (DDoS) attacks targeting top-level domain name servers are challenging to detect and mitigate due to the vulnerabilities in DNS communication protocols like UDP, which allow attackers to spoof source addresses and overwhelm servers, affecting legitimate queries and third-party servers.
Innovation Solution
A computer-implemented method and system for creating a list of trustworthy DNS resolvers by analyzing resolver profiles based on top-talker status, query distribution normalcy, IP time-to-live variance, Recursion Desired bit status, and query traffic patterns, applying policies to determine trustworthiness, and blocking untrustworthy queries to prevent attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If DNS communications use UDP protocol for low processing overhead and simplicity, then query response efficiency is improved, but vulnerability to spoofing attacks and DDoS attacks increases
Solution Approach 1:
The patent introduces an intermediary verification mechanism that checks whether responding DNS servers are actually the authoritative servers for the queried domain. This intermediary layer validates the authenticity of DNS responses without changing the underlying UDP protocol, thereby maintaining query efficiency while preventing spoofing attacks where attackers pretend to be authoritative servers.
2Reliability
If DNS servers process queries from all sources without verification, then service availability for legitimate users is maintained, but server resources are overwhelmed by DDoS attacks
Solution Approach 1:
The patent implements preliminary verification of resolver authenticity before processing DNS queries. By checking whether resolvers are authorized to query specific zones beforehand, the system prevents malicious resolvers from consuming server resources. This preliminary action filters out DDoS attackers while allowing legitimate resolvers to proceed with normal query processing, thus protecting server resources while maintaining service availability.
3Speed
If DNS servers respond to all queries including those from spoofed sources, then protocol simplicity and speed are maintained, but attack amplification effect increases
Solution Approach 1:
The patent extracts and removes malicious queries from the processing stream by identifying and blocking responses from unauthorized resolvers. This extraction mechanism selectively filters out attack traffic while allowing legitimate DNS queries to proceed at normal speed. By taking out only the harmful portion of traffic, the system maintains overall DNS response speed while eliminating the attack amplification effect.
Data Source
AI summary
Systems and methods for creating a list of trustworthy resolvers in a domain name system. A computer receives a resolver profile for a resolver sending queries to a domain name server. The resolver profile is based on any, or a combination, of a top-talker status of the resolver, a normalcy of distribution of domain names queried, a continuity of distribution of query type, and a RD bit status, and information related to query traffic based on the topology of the domain name server. Resolver profiles can be compared to a trust policy to determine whether the resolver is trustworthy. Resolvers deemed trustworthy can be added to a list of trustworthy resolvers. Embodiments can detect the occurrence of a network-based attack. Embodiments can mitigate the effect of a network-based attack by responding only to queries from resolvers on the list of trustworthy resolvers.