Encrypted DNS Filtering Through Headless Device Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DNS resolvers block DNS requests using encrypted communication protocols, leading to inaccessible websites for headless devices that cannot fallback to unencrypted protocols, resulting in poor user experience and administrative challenges.
Innovation Solution
A network device identifies headless devices and allows them to access DNS resolution services using encrypted protocols by determining device attributes and preferences, enabling seamless operation without compromising functionality.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the DNS resolver blocks encrypted DNS requests to enable filtering, then DNS filtering capability is improved, but headless devices cannot access DNS resolution service
Solution Approach 1:
The patent applies local quality by treating different device types differently. Headless devices are identified through device attributes (such as lack of DNS client software or specific hardware characteristics) and granted special permission to use encrypted DNS protocols, while other devices continue to be subject to the blocking policy. This localized differentiation resolves the contradiction by allowing encrypted DNS access specifically where needed (headless devices) while maintaining filtering capabilities for other devices.
2Reliability
If the DNS resolver inspects encrypted DNS requests, then filtering capability is improved, but root certificate management complexity increases
Solution Approach 1:
The patent extracts the certificate management complexity from individual end devices and centralizes it in the DNS resolver. Instead of requiring root certificates to be installed and managed on every end device, the DNS resolver itself possesses the necessary certificates to decrypt and inspect encrypted DNS traffic. This extraction eliminates the cumbersome distributed certificate management while maintaining centralized filtering capability.
3Reliability
If the DNS resolver inspects encrypted DNS requests, then filtering capability is improved, but user traffic speed decreases
Solution Approach 1:
The patent applies preliminary action by establishing a whitelist of trusted encrypted DNS providers in advance. The DNS resolver is pre-configured with certificates and permissions to trust specific encrypted DNS services. When a headless device uses one of these pre-approved services, the resolver can quickly verify and process the request without performing full decryption and inspection, thereby maintaining filtering capability while minimizing processing overhead and preserving traffic speed.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method, device, and system for managing Domain Name System (DNS) filtering is disclosed. The method may include blocking an end-device from accessing a domain for a predefined time duration using an encrypted communication protocol to access a domain name resolution service. The method may further include determining failure of the end-device to switch to an unencrypted communication protocol to access the domain name resolution service, after expiry of the predefined time duration. The method may include identifying the end-device as a headless device; and permitting the end-device to access the domain name resolution service using the encrypted communication protocol.