DNS Spoofing Prevention via Case Pattern Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for preventing DNS spoofing, such as firewalls, face issues with memory resource occupation and system overload due to the need to store DNS request and response packets, which can lead to Denial of Service (DoS) attacks.

Innovation Solution

A method and device that perform uppercase/lowercase conversion on DNS question fields in DNS request packets according to a preset rule, allowing only compliant DNS response packets to be forwarded to the target DNS client, thereby preventing spoofing without recording DNS request packets and conserving storage resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the firewall records DNS request packets to prevent spoofing, then DNS spoofing prevention capability is improved, but memory resource occupation increases

Engineering Contradiction:

ImproveDNS spoofing prevention capabilityVSAvoidmemory resource occupation

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent extracts only the essential verification information (uppercase/lowercase distribution pattern) from the DNS request packet and uses this extracted pattern for verification. Instead of storing entire DNS request packets in memory, the system extracts and stores only the characteristic uppercase/lowercase distribution pattern, dramatically reducing memory occupation while maintaining spoofing prevention capability.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies different quality requirements to different parts of the DNS packet. Rather than treating all packet data equally, it focuses verification efforts on the specific local characteristic of uppercase/lowercase letter distribution in the question field, which is sufficient for spoofing detection without requiring storage of the entire packet.

Inventive Principle:

Principle #3Local quality

2Reliability

If the firewall constructs and stores DNS request packets from response packets, then spoofing detection accuracy is improved, but system load increases leading to DoS

Engineering Contradiction:

Improvespoofing detection accuracyVSAvoidsystem load

Core Design Contradiction:

ReliabilityVSPower

Solution Approach 1:

The patent performs preliminary action by extracting and storing the uppercase/lowercase distribution pattern from legitimate DNS request packets before any verification is needed. This pre-extraction eliminates the need to reconstruct and store entire packets during verification, reducing real-time processing load and preventing system overload.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses a lightweight verification mechanism that does not require creating and maintaining complex packet structures. Instead of storing expensive-to-manage complete packet data, it uses simple, cheap-to-store uppercase/lowercase distribution patterns that can be quickly verified without contributing to system load.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

3Reliability

If the firewall stores extensive DNS packet data for verification, then security verification capability is improved, but storage resource consumption increases

Engineering Contradiction:

Improvesecurity verification capabilityVSAvoidstorage resource consumption

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent extracts only the critical verification feature (uppercase/lowercase distribution) from DNS packets and stores this extracted information. This extraction approach maintains security verification capability by preserving the essential anti-spoofing characteristic while eliminating the need to store redundant packet data, thus reducing storage resource consumption.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of storing complete packets and extracting features during verification, the patent inverts the approach by pre-extracting and storing only the essential verification feature (uppercase/lowercase distribution pattern). This inversion eliminates the need for extensive storage while maintaining verification capability.

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS8726375B2Method and device for preventing domain name system spoofing

Publication Date: 2014.05.13 CHENGDU HUAWEI TECH CO LTD

AI summary

A method for preventing Domain Name System (DNS) spoofing includes: performing uppercase/lowercase conversion for letters of a DNS question field in a DNS request packet according to a preset rule; sending the DNS request packet; receiving a DNS response packet; obtaining uppercase/lowercase distribution of the letters of the DNS question field in the DNS response packet; and forwarding the DNS response packet to a target DNS client if the uppercase/lowercase distribution of the letters of the DNS question field in the DNS response packet complies with the preset rule. Corresponding to the method, a device for preventing DNS spoofing is disclosed. The method and device reduce occupation of storage resources of the device.