DNS Server Address Management via Whitelist Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users accessing the internet are vulnerable to accessing ill-intended DNS servers, which can provide false IP addresses, leading to unintended sites and potential theft of personal information.
Innovation Solution
A method and apparatus for managing DNS server addresses in a communication system that detects attempts to change DNS server addresses and checks if the new address is on a list of safe addresses, preventing changes to unsafe DNS servers and redirecting to a safe one if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a DNS server address is manually designated or allocated via DHCP, then the DNS server can be accessed for URL resolution, but the system becomes vulnerable to ill-intended DNS servers providing false IP addresses
Solution Approach 1:
The system performs preliminary verification by checking whether a DNS server address included in a received DNS server address list is present in a pre-stored safe DNS server address list before allowing DNS queries. This preliminary action prevents access to ill-intended DNS servers by validating addresses in advance against a trusted whitelist, thereby resolving the vulnerability while maintaining ease of operation.
2Reliability
If the terminal checks every DNS server address change attempt, then security against ill-intended DNS servers is improved, but the operation complexity and processing time increase
Solution Approach 1:
Instead of implementing complex real-time verification mechanisms, the system applies partial action by checking only whether the DNS server address exists in the received address list against the stored safe address list. This simplified approach provides adequate security without requiring excessive processing complexity, balancing reliability with operational simplicity.
Data Source
AI summary
An apparatus and a method for managing a Domain Name System (DNS) server address in a communication system are provided. In the method for operating a terminal, an attempt to change an address of a DNS server to a first address is detected. Whether the first address is included in an address list defined in advance is determined. When the first address is not included in the address list defined in advance, the change to the first address is stopped.