Enclave-Based Security Agent for DNS Cache Poisoning Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In software-defined networking (SDN) environments, existing security measures, such as distributed firewalls, are inadequate in defending against client-side DNS cache poisoning attacks, which can divert traffic to malicious servers by exploiting vulnerabilities in the DNS protocol, posing a risk to the entire data center.
Innovation Solution
Implementing enclave-based security agents within virtual machines to independently verify DNS query replies by sending duplicate queries from isolated, reserved ports, allowing for secure detection of potential threats and remediation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If distributed firewalls are used for security, then network security is improved, but client-side DNS cache poisoning attacks can still succeed
Solution Approach 1:
The system segments security functions by deploying enclave-based security agents within individual virtual machines. Each security agent operates independently in its own secure enclave, verifying DNS queries locally rather than relying on centralized firewall protection. This segmentation allows each VM to have its own security verification mechanism, preventing cache poisoning attacks at the client side.
Solution Approach 2:
The patent introduces secure enclaves as intermediary components between the DNS client and the external DNS servers. These enclaves act as trusted mediators that verify the authenticity of DNS responses before they reach the application, blocking poisoned responses without requiring changes to the DNS protocol or existing firewall infrastructure.
2Measurement precision
If security agents send duplicate DNS queries from isolated ports, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The security agent is nested within the virtual machine's address space but operates in an isolated secure enclave. This nested architecture allows the security agent to access the VM's DNS queries while maintaining strong isolation boundaries. The enclave-based design provides a compact, self-contained security verification mechanism that doesn't require separate external infrastructure.
Solution Approach 2:
The security agent creates duplicate DNS queries using reserved source ports that are copied from the original application's query pattern. By sending identical queries with distinctive source ports, the system can verify responses without interfering with normal application operation. This copying approach simplifies the architecture by reusing existing query mechanisms rather than implementing complex verification protocols.
3Reliability
If enclave-based security agents are deployed in each virtual machine, then DNS cache poisoning detection is improved, but resource overhead increases
Solution Approach 1:
The secure enclave infrastructure provides multiple security functions within a single computational framework. The same enclave mechanism that verifies DNS queries can potentially be used for other security verification tasks, amortizing the resource cost across multiple functions. The reserved port allocation system also serves both DNS verification and potential other protocol verifications.
Solution Approach 2:
The system changes the port parameter space by allocating reserved source ports specifically for security agents. This parameter allocation allows security verification traffic to be distinguished from application traffic without requiring separate network infrastructure. By utilizing the existing port number space efficiently, the system avoids the overhead of dedicated verification network paths.
Data Source
AI summary
Example methods and systems for a computer system to perform security threat detection during service query handling are described. In one example, a process running on a virtualized computing instance supported by the computer system may generate and send a first service query specifying a query input according to a service protocol. The first service query may be detected by a security agent configured to operate in a secure enclave that is isolated from the process. Next, the security agent may generate and send a second service query specifying the query input in the first service query. It is then determined whether there is a potential security threat based on a comparison between (a) a first reply received responsive to the first service query and (b) a second reply received responsive to the second service query.