DNS Server Restricted Channels for DOS Attack Protection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Domain Name System (DNS) services are vulnerable to denial of service (DOS) attacks, which flood DNS providers with invalid requests, reducing their ability to process legitimate IP address requests and causing traffic congestion, leading to frustrated users and reduced traffic for network properties.

Innovation Solution

Implementing a server system that provides both public-facing and restricted channels for IP address requests, where trusted entities, such as Internet Service Providers (ISPs), are given exclusive access to restricted channels using configuration data to ensure legitimate requests are prioritized and protected from DOS attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If DNS services accept all IP address requests through public channels, then accessibility and ease of operation are improved, but vulnerability to DOS attacks increases

Engineering Contradiction:

ImproveDNS request accessibilityVSAvoidDOS attack vulnerability

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent segments DNS request channels into public channels and restricted channels. Public channels handle general DNS requests from any computer, while restricted channels are dedicated to trusted entities like ISPs. This segmentation allows the system to maintain open accessibility for legitimate users while creating a protected pathway that prevents DOS attacks from compromising the entire DNS service.

Inventive Principle:

Principle #1Segmentation

2Device complexity

If DNS services process all requests through single channels, then device complexity is reduced, but request handling efficiency deteriorates during attacks

Engineering Contradiction:

ImproveDNS channel structureVSAvoidLegitimate request processing capacity

Core Design Contradiction:

Device complexityVSProductivity

Solution Approach 1:

The DNS server is configured with multiple distinct channels: public channels for general requests and restricted channels for trusted entities. This segmentation increases structural complexity but dramatically improves productivity during DOS attacks by ensuring that legitimate requests from trusted sources continue to be processed even when public channels are flooded with malicious traffic.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces configuration data as an intermediary mechanism that enables trusted entities to access restricted channels. This configuration data acts as a mediator that authenticates and directs trusted requests through the restricted channel pathway, separating the authentication function from the request processing function and allowing efficient handling of legitimate traffic.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If restricted channels are provided for trusted entities, then reliability under attack is improved, but device complexity increases

Engineering Contradiction:

ImproveDNS service availability during DOS attacksVSAvoidMulti-channel DNS server structure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The DNS server is divided into distinct operational channels: public channels for general access and restricted channels for trusted entities. This segmentation improves reliability during DOS attacks by ensuring that trusted entity requests can be processed through restricted channels even when public channels are overwhelmed. The complexity increase is managed through clear channel definition and configuration data-based access control.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different channels are assigned different quality attributes: public channels are open and accessible to all, while restricted channels provide guaranteed service quality for trusted entities. This local quality differentiation ensures that critical DNS requests from trusted sources maintain high reliability and service quality regardless of the overall system load or attack conditions.

Inventive Principle:

Principle #3Local quality

4Reliability

If configuration data is communicated to enable restricted channel access, then security is improved, but loss of information increases

Engineering Contradiction:

ImproveTrusted entity access controlVSAvoidConfiguration data exposure

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

Configuration data serves as an intermediary that enables trusted entities to access restricted channels without exposing sensitive authentication credentials. The configuration data contains the necessary information for trusted entities to establish secure connections through restricted channels while minimizing the exposure of sensitive information. This intermediary approach maintains security by using configuration data as a controlled access mechanism rather than requiring direct sharing of sensitive credentials.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10356097B2Domain name system and method of operating using restricted channels

Publication Date: 2019.07.16 DIGICERT INC

AI summary

A server system for a domain name system (DNS) which operates to concurrently provide both public-facing and restricted channels for receiving and handling Internet Protocol (IP) address requests from a population of computers. The server system implements an alternative DNS request handling process to provide a trusted computer entity with exclusive access to the restricted channels.