DNS Snooping Trust Database for Selective Deep Packet Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deep Packet Inspection (DPI) at layer 7 is resource-intensive and wasteful when performed on data packets from reputable sources, as it requires parsing all packets to determine which are suspicious or pose a security risk, even though many originate from trusted websites.
Innovation Solution
Creating an IP address-based trust database that maps IP addresses to trust metrics based on domain name reputations, allowing network devices to intercept DNS transactions to determine the trustworthiness of IP packets, thereby avoiding unnecessary layer 7 DPI and storage of non-suspicious packets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If layer 7 DPI is performed on all data packets to ensure security, then security detection capability is improved, but resource consumption increases
Solution Approach 1:
The patent performs preliminary actions by snooping DNS transactions in advance to build a trust database mapping IP addresses to trust metrics. This preliminary classification allows the firewall to make quick trust decisions before DPI processing, avoiding unnecessary layer 7 inspection of packets from trusted sources and thereby reducing resource consumption while maintaining security detection capability for suspicious packets
Solution Approach 2:
The patent applies partial action by selectively performing layer 7 DPI only on packets from untrusted or suspicious sources identified through the trust database, rather than examining all packets. This partial inspection approach maintains adequate security detection while significantly reducing the resource consumption associated with universal deep packet analysis
2Reliability
If layer 7 DPI is performed on packets from reputable sources, then security risk detection is improved, but processing efficiency deteriorates
Solution Approach 1:
The system performs preliminary DNS snooping to classify IP addresses into trusted and untrusted categories before DPI processing. This pre-classification enables the firewall to efficiently route packets from reputable sources without layer 7 inspection, maintaining security risk detection for actual threats while dramatically improving processing efficiency by avoiding redundant inspection of trusted traffic
Solution Approach 2:
The patent applies local quality by treating different packets differently based on their source IP address trust metrics. Packets from trusted sources receive expedited processing without deep inspection, while packets from untrusted sources undergo full layer 7 DPI. This differentiated approach maintains security risk detection capability where needed while improving overall processing efficiency through selective inspection
3Reliability
If all data packets are stored for security analysis, then forensic capability is improved, but storage resources are wasted
Solution Approach 1:
The system performs preliminary classification using the trust database to identify suspicious packets before storage. Only packets from untrusted sources or those flagged as suspicious are stored in the repository, while packets from trusted sources are discarded. This preliminary filtering maintains forensic capability for actual security incidents while dramatically reducing storage resource consumption by eliminating redundant storage of benign traffic
4Measurement precision
If DNS snooping is performed to build trust database, then processing accuracy is improved, but device complexity increases
Solution Approach 1:
The patent introduces an intermediary trust database that stores pre-computed trust metrics for IP addresses. The DNS snooping process builds this intermediary database by observing DNS transactions and inferring trust relationships. This intermediary structure simplifies the overall system by providing a ready-reference trust classification that avoids complex real-time analysis, thereby improving measurement precision while managing device complexity through structured data organization
Data Source
AI summary
At a network device through which client devices communicate with a network, a database is created that maps Internet Protocol (IP) addresses each to a respective trust metric for a domain name associated with the IP address. An IP packet sent from a client device to the network and that indicates a destination IP address for a network-accessible resource associated with a domain name is intercepted. Using the destination IP address in the intercepted IP packet, the domain name trust metric mapped to the destination IP address is retrieved from the database. IP packets received from the destination IP address are processed based on the retrieved domain name trust metric and a predetermined trust metric criterion.