DNS Response Interception for Encrypted Traffic Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying network traffic carrying encrypted data packets has become difficult and computationally expensive due to the adoption of encryption technologies like TLS/SSL, rendering traditional deep packet inspection methods ineffective.
Innovation Solution
A system and method that intercepts and analyzes DNS responses to create a mapping between CDN server IP addresses and domain names, allowing for the identification of data flows even when application-level packet data is encrypted, using a reverse DNS lookup table to implement network management policies without decrypting data packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If deep packet inspection is used to identify network traffic, then network traffic identification is achieved, but computational cost increases significantly and encryption effectiveness is compromised
Solution Approach 1:
The patent extracts only the necessary identification information (domain names) from DNS response packets rather than inspecting the entire encrypted payload. By capturing domain names at the DNS layer before encryption occurs, the system achieves traffic identification without the computational burden of deep packet inspection into encrypted data.
Solution Approach 2:
The system performs domain name capture during the DNS resolution phase, which occurs before the actual encrypted data transmission. By identifying traffic patterns at this preliminary stage using unencrypted domain names, the system avoids the need for computationally expensive post-encryption inspection while maintaining identification accuracy.
2Measurement precision
If deep packet inspection is performed on encrypted data packets, then network traffic can be identified, but the process becomes time-consuming and complex
Solution Approach 1:
The patent extracts domain name information from DNS response packets at the application layer, which are unencrypted and contain sufficient identification data. This extraction approach eliminates the time-consuming process of attempting to inspect encrypted payloads while maintaining the ability to identify and categorize network traffic effectively.
3Reliability
If traditional identification methods are used, then network traffic can be monitored, but effectiveness is reduced due to encryption hiding data
Solution Approach 1:
The patent uses domain names as an intermediary identifier that bridges the gap between encrypted traffic and meaningful identification. By monitoring the unencrypted domain names in DNS requests and responses, the system can reliably identify traffic patterns, applications, and services without needing to access or decrypt the hidden application layer data.
Data Source
Figure 1
Figure 2
Figure 3A~3C
AI summary
A method includes intercepting a first data packet being transmitted from a domain name system (DNS) server to a first client device, the first data packet being a DNS response, extracting a first internet protocol (IP) address and a first hostname from the first data packet, and storing the first IP address and the first hostname in a first entry of an identification table.