Domain Name Resolution Request Rerouting Through Authorized DNS Servers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet access providers are unable to control domain name resolution requests when secure protocols like DNS over HTTPS are used, leading to a loss of control over network traffic and security measures such as parental controls and load distribution.
Innovation Solution
An interface device intercepts domain name resolution requests, identifies unauthorized servers, and reroutes them to authorized servers, ensuring that all requests are processed through trusted DNS servers, even if encrypted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS over HTTPS protocol is used to encrypt domain name resolution requests, then user confidentiality and security are improved, but Internet access providers lose control over network traffic and inability to enforce policies
Solution Approach 1:
The patent introduces a home gateway as an intermediary device between the user terminal and the DNS servers. The gateway intercepts encrypted DNS over HTTPS requests from terminals, decrypts them using TLS/SSL certificates, processes them through authorized DNS servers, and forwards the results back to terminals. This mediator approach allows Internet access providers to maintain control over DNS traffic while preserving user confidentiality during transmission.
Solution Approach 2:
The system segments the DNS resolution process into multiple stages: (1) Terminal sends encrypted request to home gateway, (2) Gateway decrypts and processes request through authorized DNS servers, (3) Gateway forwards resolved information back to terminal. This segmentation allows different security and control mechanisms to be applied at different stages, maintaining both encryption benefits and provider control.
2Reliability
If DNS requests are sent directly to external DNS servers using secure protocols, then encryption and security are improved, but filtering operations and parental controls cannot be implemented
Solution Approach 1:
The home gateway performs preliminary decryption and filtering actions before requests reach external DNS servers. By intercepting and decrypting requests at the gateway level, the system can apply filtering rules, parental controls, and load distribution policies before the encrypted traffic leaves the home network, thus maintaining both security and control capabilities.
3Reliability
If encrypted DNS requests bypass home gateway control, then user privacy is protected, but load distribution and malicious behavior detection are compromised
Solution Approach 1:
The home gateway acts as a mandatory intermediary that all DNS traffic must pass through. It decrypts requests using stored TLS/SSL certificates, enabling the Internet access provider to detect malicious behaviors, distribute load across multiple DNS servers, and enforce policies while maintaining user privacy during the actual DNS query transmission.
Data Source
AI summary
A method for processing requests sent by a user terminal, carried out by an interface device allowing the user terminal to access a communication network. The method includes: when a received request is detected as intended for being transmitted to a server not authorized by the interface device, receiving a second request intended for being sent to a resolution server associated with the interface device among resolution servers associated with the interface device, and transmitting, to the resolution server associated with the interface device, the second request received or a third request generated by the interface device from the second request received.