Encrypted DNS Provisioning for Consistent Filtering on Untrusted Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Newer DNS protocols like DNS over TLS (DOT) and DNS over HTTPS (DOH) encrypt DNS traffic, preventing local caching DNS servers from providing security and filtering services, and existing solutions struggle to enforce network access controls when devices roam to untrusted networks.
Innovation Solution
A system that provisions devices with a network-provided DOH or DOT server and client identity certificates using Enrollment over Secure Transport (EST), enabling seamless DNS-based security and parental control filtering even on untrusted networks through a minimal agent that authenticates with the DNS server.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS over TLS (DOT) or DNS over HTTPS (DOH) encryption is used, then user privacy and security are improved, but local caching DNS servers can no longer provide security and filtering services
Solution Approach 1:
The patent introduces a proxy server positioned between the client device and the encrypted DNS server. This proxy acts as an intermediary that receives encrypted DNS queries, validates them against security policies, and forwards them to the DNS server while maintaining encryption. The proxy enables local security filtering to work alongside DOT/DOH encryption without compromising either function.
Solution Approach 2:
The security function is segmented into multiple components: the proxy server handles local policy validation and filtering, while the encrypted DNS server handles resolution. This segmentation allows each component to operate independently with its specific function, enabling both local security control and encrypted communication to coexist.
2Reliability
If existing DNS security solutions are deployed, then network access controls can be enforced on trusted networks, but they fail when devices roam to untrusted networks
Solution Approach 1:
The proxy server is designed with universal functionality that operates consistently across both trusted and untrusted networks. It performs the same security validation and filtering functions regardless of network trust status, ensuring uniform security enforcement. The system can detect network trust status and adapt its behavior accordingly while maintaining consistent policy application.
Solution Approach 2:
The system performs preliminary security validation of DNS queries before they are forwarded to the DNS server. By validating queries upfront against security policies, the system ensures that untrusted networks cannot introduce malicious DNS requests, maintaining security enforcement across all network types.
3Reliability
If manual configuration is required for DNS security services, then security can be customized, but device complexity and user burden increase
Solution Approach 1:
The proxy server automatically detects the presence of DOT/DOH encrypted DNS servers and configures itself without user intervention. It self-adjusts its operation based on network conditions and security policies, eliminating the need for manual configuration while maintaining customized security enforcement.
Solution Approach 2:
The system dynamically adjusts operational parameters based on detected network conditions and security policies. When encrypted DNS servers are detected, the proxy automatically changes its configuration to work with encryption, eliminating manual configuration needs while maintaining security customization through policy-based parameter adjustment.
Data Source
AI summary
The present specification provides a system and method for determining that an endpoint device has connected to an untrusted external internet protocol (IP) network; and establishing a secure DNS connection from the endpoint device to a trusted DNS server via a proxy, wherein the proxy authenticates the trusted DNS server via a client identity certificate and a server certificate.