DNSSEC Query Cipher Optimization via Common Cipher Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing DNSSEC system faces inefficiencies in managing secure name lookup queries due to the inclusion of cipher suites in query messages, leading to network congestion, IP fragmentation, and amplified DDoS attacks, as local and name servers often lack knowledge of each other's supported ciphers.
Innovation Solution
A system that learns the cipher suites of name servers from response messages and creates a data structure to select and strip unnecessary ciphers from query messages, using a management device to determine and apply a common cipher for secure communication, reducing the size of query messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a list of ciphers is appended to each name lookup query message to enable secure communication, then secure communication between local servers and name servers is improved, but the size of query messages increases significantly
Solution Approach 1:
The system performs preliminary actions by learning the cipher suites supported by name servers in advance through response messages. This learned information is stored in a data structure, so when query messages are later sent, the cipher list is already known and can be optimized, eliminating the need to append comprehensive cipher lists to each query message.
Solution Approach 2:
The system extracts only the necessary cipher information from the comprehensive cipher list. Instead of including all possible ciphers in each query message, the system identifies and retains only the common cipher that is supported by both the local server and the name server, removing redundant cipher entries.
2Adaptability or versatility
If comprehensive cipher lists are included in query messages to ensure compatibility, then adaptability between different servers is improved, but network congestion and IP fragmentation occur
Solution Approach 1:
The system performs preliminary learning of name server cipher support through response messages and stores this information in a data structure. This advance preparation enables the system to determine cipher compatibility before constructing query messages, ensuring adaptability without needing to include comprehensive cipher lists that cause network congestion.
Solution Approach 2:
The system creates an optimized copy of the cipher list containing only the common cipher needed for communication. Instead of transmitting the full cipher list, the system uses the learned information to generate a minimal cipher specification that maintains compatibility while reducing message size and preventing network congestion.
3Reliability
If cipher lists are appended to query messages to support cryptographic encryption, then security against malicious activities is improved, but the queries become vulnerable to amplified DDoS attacks
Solution Approach 1:
The system performs preliminary learning of cipher suite information through normal response messages. This advance knowledge allows the system to construct optimized query messages with minimal cipher specifications, maintaining security through the common cipher while avoiding the message size amplification that makes queries vulnerable to DDoS attacks.
Solution Approach 2:
The system extracts only the essential cipher information needed for secure communication. By removing redundant cipher entries and retaining only the common cipher, the system maintains security against malicious activities while significantly reducing the message size that would otherwise be exploited in amplified DDoS attacks.
Data Source
AI summary
One embodiment of the present invention provides a system. During operation, the system determines a first set of ciphers supported by a name server based on a name lookup response message. The system then inserts an entry associated with the name server in a data structure stored in a local storage device. Subsequently, the system identifies a second set of ciphers supported by a local name server in a name lookup query message destined to the name server. The system then selects the name lookup query message for an update operation based on the entry in the data structure. The update operation includes removing ciphers from the name lookup query message except a common cipher, which is present in both the first and second sets of ciphers. The system determines an egress port corresponding to the name server for the updated name lookup query message.