DNS Server Pre-fetching Certificates for TLS Proxy Validation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Transport Layer Security (TLS) proxies face security vulnerabilities due to the inability to determine the appropriate trust anchor for server certificates and the risk of man-in-the-middle attacks when certificate authorities become compromised, as they rely on default trust anchor lists and lack visibility into DNS-Based Authentication of Named Entities (DANE) records.

Innovation Solution

A network security system that pre-fetches domain information including certificate information from a DNS server and conveys it through a Network Service Header (NSH) to a TLS proxy, enabling the TLS proxy to validate server certificates using DANE records, even when endpoint devices do not support DANE, thereby enhancing security by leveraging DNSSEC.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a TLS proxy uses a default trust anchor list to validate server certificates, then certificate validation can be performed, but the TLS proxy cannot determine which trust anchor should vouch for the specific domain and is vulnerable to man-in-the-middle attacks

Engineering Contradiction:

Improvecertificate validation reliabilityVSAvoidtrust anchor selection complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces DNSSEC as an intermediary mechanism that provides cryptographic proof of domain ownership. The DNSSEC-signed DNS records act as a mediator between the domain and trust anchors, allowing the TLS proxy to verify domain ownership without needing to manually select from multiple trust anchors. This resolves the contradiction by providing automated, cryptographically-verifiable domain identification.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent performs DNSSEC validation and certificate information retrieval in advance during the DNS resolution phase, before the actual TLS connection is established. By pre-fetching and validating certificate information through DNSSEC, the system prepares the necessary validation data beforehand, eliminating the need for complex real-time trust anchor selection during TLS handshake.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If any domain can be vetted by any certificate authority, then certificate issuance is flexible, but all domains become vulnerable to man-in-the-middle attacks if a certificate authority is compromised

Engineering Contradiction:

Improvecertificate issuance flexibilityVSAvoidman-in-the-middle attack vulnerability

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies DNSSEC signatures as a preliminary anti-action measure that cryptographically binds specific certificate authorities to specific domains before any certificate issuance occurs. This pre-established cryptographic binding prevents unauthorized CAs from issuing certificates for domains, even if those CAs are compromised, because any certificate not signed by the authorized CA will fail DNSSEC validation.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The patent implements a feedback mechanism where the TLS proxy continuously validates server certificates against DNSSEC-signed records. This creates a closed-loop verification system where certificate validity is constantly checked against the authoritative DNSSEC data, providing real-time feedback that detects and blocks man-in-the-middle attacks attempting to use certificates from compromised CAs.

Inventive Principle:

Principle #23Feedback

3Adaptability or versatility

If endpoint devices do not support DANE, then device compatibility is maintained, but TLS proxies cannot leverage DNSSEC for enhanced security

Engineering Contradiction:

Improvedevice compatibilityVSAvoidTLS proxy security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent segments the security validation function by separating DNSSEC validation from the endpoint device's TLS implementation. The TLS proxy performs DNSSEC validation independently as an intermediate security layer, allowing endpoint devices to maintain basic TLS compatibility while the proxy provides enhanced security through DNSSEC-validated certificate verification.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS10009336B2Network security system to validate a server certificate

Publication Date: 2018.06.26 CISCO TECHNOLOGY INC

AI summary

In one embodiment, a Domain Name Service (DNS) server pre-fetches domain information regarding a domain that includes certificate information for the domain. The DNS server receives a DNS request that includes a security request for the domain in metadata of a Network Service Header (NSH) of the DNS request. The DNS server retrieves the certificate information for the domain from the pre-fetched information regarding the domain, in response to receiving the security request. The DNS server sends, to a Transport Layer Security (TLS) proxy, a DNS response for the domain that includes the certificate information in metadata of an NSH of the DNS response.