Endpoint DNS Agent for NAT Client Distinction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based DNS security systems face challenges in distinguishing between client devices due to Network Address Translation (NAT), leading to difficulties in configuring different permissions and accurately logging threats, and they struggle to provide effective security for client devices behind firewalls or gateways.
Innovation Solution
Implementing an endpoint Domain Name Server (DNS) agent on client devices to intercept and process DNS requests based on a security policy, differentiate between local and external domains, and redirect requests through a local or cloud-based DNS server, with the option to override DNS redirections and route them through a tunnel server for filtering malicious content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud-based DNS server is used to provide security for multiple clients, then security coverage is improved, but ability to distinguish between client devices deteriorates due to NAT masking
Solution Approach 1:
The patent introduces an endpoint DNS agent as an intermediary component installed on each client device. This agent acts as a local mediator between the client device and the cloud-based DNS server, enabling the system to distinguish between different clients even when NAT masking is applied. The endpoint agent maintains device-specific security policies and logs, resolving the contradiction by providing both broad cloud-based security coverage and precise client-level distinction.
2Ease of operation
If endpoint DNS agent is implemented on client devices, then device-level security control is improved, but system complexity increases
Solution Approach 1:
The patent segments the DNS security system into two distinct components: a cloud-based DNS server that provides centralized security policies and threat intelligence, and endpoint DNS agents installed on individual client devices that enforce local policies and maintain device-specific logs. This segmentation allows the system to provide granular device-level control without overwhelming complexity, as each component has a specialized function.
Solution Approach 2:
The endpoint DNS agent is designed to autonomously enforce security policies, log threats, and manage device-specific DNS requests without requiring constant manual configuration or intervention. This self-service capability simplifies operation while maintaining comprehensive device-level control, as the agent automatically adapts to its specific device context.
3Reliability
If DNS requests are redirected through local DNS server, then security filtering is improved, but network latency increases
Solution Approach 1:
The endpoint DNS agent performs preliminary actions by maintaining local caches of DNS resolutions and pre-fetching security policies for commonly accessed domains. This preliminary preparation reduces the need for real-time cloud server communication for every DNS request, thereby improving security filtering while minimizing the latency impact of redirection through the local DNS server.
Data Source
AI summary
A network is secured by managing domain name requests such that client devices are restricted from visiting malicious or undesirable domains. An endpoint Domain Name Server (DNS) agent is installed on client devices on a local network, and the endpoint DNS agents intercept DNS requests from the client devices and process the received DNS request in the endpoint DNS agent based on a security policy set for the client device via the endpoint DNS agent. In a further example, the endpoint DNS agent receives an HTTP message from a client browser including a Server Name Identifier tag, and generates a signed certificate spoofing the domain identified in the Server Name Identifier tag to insert itself as a man-in-the-middle between the identified domain and the client browser.