DNS Smart Access Agent for Trusted Resolver Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DNS systems face issues with visibility, privacy, and security, including exposure of user activities, susceptibility to malware, and vulnerabilities such as DNS tunneling and hijacking.
Innovation Solution
Implementing a DNS smart access agent that intercepts DNS requests and ensures all communications are routed through a trusted DNS resolver, using a local cache and monitoring outbound communications to block unauthorized addresses, and employing secure DNS protocols like DoH and DoT to maintain control and visibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional DNS resolution is used, then DNS requests can be processed, but user privacy is exposed and network visibility is lost
Solution Approach 1:
The patent introduces a smart access agent as an intermediary component between the application and the DNS resolver. This agent intercepts DNS requests, checks them against a cache of trusted addresses, and blocks requests to untrusted domains. The agent acts as a mediator that maintains DNS resolution functionality while enforcing security policies, thus preserving user privacy and network visibility without compromising DNS reliability
2Ease of operation
If DNS requests are allowed without restriction, then network access is maintained, but security vulnerabilities such as DNS tunneling and malware exposure occur
Solution Approach 1:
The patent implements preliminary action by pre-populating a cache with trusted DNS resolver addresses before DNS requests are made. The smart access agent checks each DNS request against this pre-established cache of trusted addresses. This preliminary preparation allows the system to quickly block malicious requests while allowing legitimate ones, maintaining network access convenience while preventing security threats like DNS tunneling and malware exposure
Solution Approach 2:
The smart access agent serves as an intermediary that sits between the application and the DNS resolution process. It intercepts DNS requests, validates them against the trusted cache, and blocks suspicious requests before they reach external DNS resolvers. This intermediary mechanism maintains ease of operation for legitimate traffic while providing security filtering against harmful factors
3Reliability
If a smart access agent blocks untrusted DNS addresses, then security is improved, but access to legitimate addresses may be restricted
Solution Approach 1:
The patent implements feedback mechanisms where the smart access agent monitors DNS resolution outcomes and updates its cache of trusted addresses based on successful resolutions. When a DNS request to a previously unknown address succeeds, the agent learns from this feedback and adds the address to its trusted cache, allowing future access. This feedback loop maintains high security while gradually improving access flexibility as the system learns legitimate traffic patterns
Solution Approach 2:
The smart access agent employs dynamic behavior by continuously updating its cache of trusted addresses based on observed DNS resolution successes and failures. The system adapts its blocking rules over time, transitioning from a static whitelist to a dynamic trust model. This dynamic approach maintains strict security initially while gradually increasing adaptability and access flexibility as legitimate patterns are learned and trusted
Data Source
AI summary
Embodiments of systems and methods for DNS smart access are disclosed herein. In particular, certain embodiments include a local cache of trusted addresses resolved by a trusted DNS resolver. A DNS smart access agent monitors outbound communications from applications or processes on a client device. The DNS smart access agent blocks access to addresses that were not resolved through the trusted DNS resolver.