DNS Security Using TCP Retry to Filter Spoofed UDP Queries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User Datagram Protocol (UDP)-based DNS requests are vulnerable to source-spoofing, making them susceptible to malicious network attacks such as Distributed Denial of Service (DDoS) traffic, which are difficult to distinguish from normal DNS traffic.
Innovation Solution
Implementing a system that requires DNS queries to be reattempted by setting a truncate flag in UDP responses, prompting clients to resend requests via Transmission Control Protocol (TCP), and using AI/ML to evaluate subsequent UDP attempts to determine if the source should be trusted or blocked.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If UDP-based DNS requests are used, then DNS query speed and simplicity are improved, but security against source-spoofing attacks deteriorates
Solution Approach 1:
The system performs preliminary validation by checking if the client resends the query via TCP within a predetermined time window. This preliminary action (requiring TCP confirmation) allows the system to distinguish legitimate clients from attackers before fully processing their UDP queries, thus maintaining speed for legitimate traffic while improving security.
Solution Approach 2:
The patent introduces TCP as an intermediary verification mechanism. When a UDP query is received, the system requires confirmation via TCP within a specific time window. This intermediary step acts as a trust verification layer, allowing the system to maintain fast UDP processing for legitimate clients while blocking source-spoofed packets that fail the TCP verification.
2Reliability
If all UDP DNS requests are blocked to prevent attacks, then security is improved, but legitimate DNS traffic is also blocked
Solution Approach 1:
The system dynamically adjusts its behavior based on the client's response to the initial UDP query. Legitimate clients that resend via TCP within the time window are granted access, while those that don't respond or respond outside the window are blocked. This dynamic approach allows the system to differentiate between legitimate and malicious traffic in real-time.
Solution Approach 2:
The system uses feedback from the client's TCP response to determine whether to allow or block subsequent UDP queries. By monitoring whether clients resend their queries via TCP within the predetermined period, the system receives feedback that indicates legitimacy, allowing it to maintain security while preserving legitimate traffic flow.
3Reliability
If TCP-based DNS requests are required for all queries, then security against source-spoofing is improved, but network overhead and query time increase
Solution Approach 1:
Instead of requiring TCP for all DNS queries, the system applies TCP verification only partially - specifically, only for clients that send UDP queries. Legitimate clients that already use TCP or resend via TCP within the time window receive full service, while the system avoids the overhead of TCP handshakes for clients that don't initiate UDP queries or are already verified.
Data Source
AI summary
Novel tools and techniques are provided for implementing improvement to domain name system (“DNS”) security. In various embodiments, a computing system may receive a user datagram protocol (“UDP”)-based DNS request, and may send a UDP-based response message, which may include an empty payload portion and a header portion containing a truncate flag that is set, which indicates to resend the request as a transmission control protocol (“TCP”)-based DNS request. When the TCP-based DNS request is received within a first period, the computing system may send, to the source address, a TCP-based response message comprising an answer to a query (in the TCP-based DNS request) for a destination DNS record associated with a destination device. If no TCP-based DNS request is received from the source address within the first period, the computing system may block all UDP-based DNS requests from the source address for at least a second period.