DNS Security Token Intermediary for Latency Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS communication methods, such as DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH), face performance issues due to computational loads, which can lead to latency and vulnerability to interceptors.
Innovation Solution
A method where a client device sends an encrypted DNS request to an encryption module, which decrypts the request to determine the IP address and port associated with the DNS client, generates a security token using a hash function, and communicates with the DNS server to ensure secure and efficient DNS communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing encryption methods are used to protect DNS messages, then security against interceptors is improved, but performance deteriorates due to computational load
Solution Approach 1:
The patent introduces an intermediary encryption module that sits between the client device and DNS server. This module handles the encryption and decryption operations, allowing the DNS server to operate without direct computational burden for these tasks. The intermediary absorbs the computational load while maintaining security, thus resolving the contradiction between security improvement and performance deterioration.
Solution Approach 2:
The system segments the encryption functionality from the core DNS resolution process. By separating the encryption module into a distinct component that processes requests before they reach the DNS server, the patent allows the DNS server to focus on resolution tasks while security operations are handled independently, improving overall performance without compromising security.
2Object-affected harmful factors
If encryption is applied to DNS messages, then protection against malicious actions is improved, but latency increases due to computational processing requirements
Solution Approach 1:
The encryption module performs encryption operations in advance, before the DNS request reaches the server. By pre-processing the encryption and using security tokens for rapid authentication, the system reduces the processing time required during the actual DNS resolution, thereby minimizing latency while maintaining protection against interceptors.
Solution Approach 2:
The intermediary encryption module handles all cryptographic operations externally, preventing them from blocking the core DNS resolution pathway. This separation ensures that encryption overhead is incurred only once during token generation, rather than being repeatedly processed during each DNS query, thus reducing latency.
3Reliability
If encryption modules are introduced to secure DNS communications, then security is improved, but device complexity increases
Solution Approach 1:
The encryption module is designed as a universal component that can be integrated into various DNS communication scenarios without requiring separate complex implementations for each case. By creating a single multi-functional module that handles encryption, decryption, and security token generation, the patent reduces overall system complexity compared to having multiple dedicated security components.
Data Source
AI summary
An encrypted message comprising a DNS request may be received from a client device. The DNS request may be decrypted to determine an IP address and a port associated with the client device. A security token may be determined based on the IP address and the port. A message comprising an indication of the DNS request and the security token may be sent to a DNS server. A reply comprising a payload and the security token may be received from the DNS server. Based on the security token, an indication of the payload of the reply may be sent to the client device.