DNS Security Through UDP-to-TCP Source Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User Datagram Protocol (UDP)-based DNS requests are vulnerable to source-spoofing, making them susceptible to malicious network attacks like Distributed Denial of Service (DDoS), which are difficult to distinguish from normal traffic.
Innovation Solution
Implementing a method where a computing system responds to a UDP-based DNS request with an empty payload and a set truncate flag, requiring a subsequent TCP-based request within a predetermined period. If no TCP request is received, subsequent UDP requests are blocked, and an AI/ML system evaluates further requests to determine if the source should be banned.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If UDP-based DNS requests are used, then processing speed and simplicity are improved, but security vulnerability to source-spoofing and DDoS attacks worsens
Solution Approach 1:
The patent applies preliminary action by requiring clients to send a TCP-based DNS request within a predetermined time period after sending a UDP request. This preliminary TCP verification step is performed before the DNS server processes the UDP query, allowing the server to validate the client's legitimacy in advance. If the TCP request is not received within the time period, the server blocks subsequent UDP requests from that source, preventing potential DDoS attacks before they can overwhelm the system.
Solution Approach 2:
The patent uses TCP protocol as an intermediary mechanism between UDP-based DNS requests and the final DNS resolution process. The TCP connection serves as a mediator that verifies client legitimacy before allowing UDP queries to be processed. This intermediary layer filters out malicious source-spoofed requests while allowing legitimate UDP traffic to pass through, thus resolving the contradiction between maintaining fast UDP processing and preventing security attacks.
2Reliability
If all UDP-based DNS requests are processed, then service availability is improved, but system resources are consumed by malicious DDoS traffic
Solution Approach 1:
The patent performs preliminary verification by requiring TCP-based DNS requests within a predetermined time period after UDP requests. This preliminary check identifies and blocks malicious sources before they can consume significant system resources. The TCP handshake and verification process acts as a filter that prevents DDoS traffic from reaching the resource-intensive DNS resolution stage, thus maintaining service availability for legitimate users while conserving system resources.
Solution Approach 2:
The patent applies partial action by selectively processing only those UDP requests that are followed by a valid TCP request within the time period. Rather than processing all UDP requests equally, the system performs partial verification on a per-client basis. This approach ensures that legitimate traffic receives full service while malicious traffic is blocked, optimizing resource allocation between valid and invalid requests.
3Object-affected harmful factors
If TCP-based verification is required for all UDP requests, then security is improved, but processing time and complexity increase
Solution Approach 1:
The patent implements periodic verification by requiring TCP-based DNS requests within a predetermined time period (e.g., a few seconds) after UDP requests. This time-bound periodic check balances security needs with performance requirements. The verification is not continuous or permanent but occurs periodically within the specified time window, allowing legitimate fast UDP transactions to complete quickly while still providing security verification when needed. This periodic approach minimizes the time penalty for security checks while maintaining effective protection against source-spoofing attacks.
Data Source
AI summary
Novel tools and techniques are provided for implementing improvement to domain name system (“DNS”) security. In various embodiments, a computing system may receive a user datagram protocol (“UDP”)-based DNS request, and may send a UDP-based response message, which may include an empty payload portion and a header portion containing a truncate flag that is set, which indicates to resend the request as a transmission control protocol (“TCP”)-based DNS request. When the TCP-based DNS request is received within a first period, the computing system may send, to the source address, a TCP-based response message comprising an answer to a query (in the TCP-based DNS request) for a destination DNS record associated with a destination device. If no TCP-based DNS request is received from the source address within the first period, the computing system may block all UDP-based DNS requests from the source address for at least a second period.