DNS Response Validation for Cache Poisoning Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

DNS cache poisoning attacks can redirect users to malicious sites, compromising network security and user data, as existing DNS systems are vulnerable to false information being stored in caches, affecting multiple users and requiring a solution to prevent such attacks with minimal modifications.

Innovation Solution

A method and system that compare DNS responses from multiple caches to identify and prevent poisoning by using a DNS query analyzer, broadcaster, comparator, and databases to verify responses, ensuring consistency and security in DNS resolution across a network.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If DNS cache is used to optimize response time and avoid server overload, then response speed and system efficiency are improved, but the system becomes vulnerable to DNS cache poisoning attacks

Engineering Contradiction:

ImproveDNS query response speedVSAvoidDNS cache security

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent implements a feedback mechanism where DNS responses from multiple caches are compared and validated. The system receives DNS responses from multiple caches, compares them to identify inconsistencies, and uses this feedback to detect and block poisoned responses before they reach users, thus maintaining both speed and security

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent introduces an intermediary validation layer between the DNS caches and users. This intermediary component compares DNS responses from multiple caches and filters out poisoned responses, allowing the system to maintain high response speed while blocking malicious content

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If DNS cache stores responses for extended periods to reduce query frequency, then system efficiency is improved, but the impact of poisoning attacks is amplified

Engineering Contradiction:

ImproveQuery frequency reductionVSAvoidPoisoning attack impact

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system continuously monitors and compares DNS responses from multiple caches. When a poisoning attack is detected through response comparison, the feedback mechanism enables rapid invalidation of the poisoned cache entries, limiting the duration and impact of the attack despite extended cache storage

Inventive Principle:

Principle #23Feedback

3Reliability

If multiple DNS caches are deployed in a distributed system to improve reliability and load distribution, then system robustness is improved, but the complexity of preventing poisoning attacks increases

Engineering Contradiction:

ImproveSystem robustnessVSAvoidPoisoning prevention complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent uses a comparison-based feedback system where DNS responses from multiple caches are automatically compared. This approach leverages the distributed architecture's redundancy to detect poisoning through inconsistencies, transforming the complexity of managing multiple caches into an advantage for automatic detection without requiring complex additional prevention mechanisms

Inventive Principle:

Principle #23Feedback

Data Source

PatentEP2526670B1Method and system for preventing DNS cache poisoning

Publication Date: 2015.03.04 ALCATEL LUCENT SA

Figure 1

AI summary

The invention relates to a method for preventing poisoning of at least one DNS cache (5_i) in a computer network (B) including a plurality of DSN caches (5_1, 5_i, 5_n), said method including a step of comparing at least two DNS responses to a DNS request, said responses being returned by two different DNS caches.