Firewall DNS Validation via Query Caching Database
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in preventing client devices from connecting to potentially malicious IP addresses, especially when using DNS over HTTPS, which allows clients to bypass internal DNS servers, making it difficult for firewalls to block unauthorized connections without blocking all HTTPS traffic.
Innovation Solution
A method that stores client DNS resolution requests in a query caching database to determine the validity of connection requests, allowing only approved connections through enterprise DNS servers, thereby preventing unauthorized access by linking DNS requests with firewall authorizations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS over HTTPS is used by client devices, then encryption and privacy are improved, but the ability of internal DNS servers to control and monitor domain resolution is worsened
Solution Approach 1:
The patent introduces an intermediary mechanism where the firewall acts as a mediator between the DNS over HTTPS traffic and the internal DNS resolution system. The firewall intercepts DNS over HTTPS traffic, extracts domain name information, and uses this to validate connection requests against a database of previously resolved domains, thereby maintaining DNS control without blocking HTTPS traffic.
Solution Approach 2:
The patent replaces the traditional mechanical DNS resolution control mechanism with a database-driven validation system. Instead of relying solely on internal DNS servers to block resolutions, the system uses a database of previously resolved domains and validates connection requests against this database, substituting the mechanical DNS control with a data-based validation approach.
2Reliability
If firewalls block all HTTPS traffic to prevent DNS over HTTPS bypasses, then DNS-based security controls are improved, but legitimate HTTPS traffic is also blocked
Solution Approach 1:
The patent applies partial action by not blocking all HTTPS traffic, but rather selectively validating connection requests based on database records. The system allows HTTPS traffic that corresponds to previously resolved domains while blocking only those that do not match the database, achieving selective security control without unnecessary blocking of legitimate traffic.
Solution Approach 2:
The patent implements feedback by maintaining a database of previously resolved domain names and using this information to validate subsequent connection requests. The system continuously updates and references this database to determine whether to allow or block HTTPS connections, creating a feedback loop that adapts to legitimate traffic patterns while blocking malicious attempts.
3Reliability
If internal DNS servers implement security controls to block malicious destinations, then network security is improved, but client devices lose the ability to resolve certain domains
Solution Approach 1:
The patent segments the security control function from the DNS resolution function. Instead of internal DNS servers directly blocking domain resolutions, the system separates DNS resolution (handled by external DNS over HTTPS) from security validation (handled by the firewall checking the database). This segmentation allows security controls to be applied at the connection validation stage rather than at the DNS resolution stage, preserving domain resolution capability while maintaining security.
Data Source
AI summary
A computer-implemented method, according to one embodiment, includes causing a client DNS resolution request to be stored to a predetermined query caching database, and receiving a request from a firewall to determine a validity of a connection request received by the firewall from a client device. The connection request is for a resolved IP address associated with the client DNS resolution request. Contents of the predetermined query caching database are used to determine the validity of the connection request. The method further includes using the determined validity results to control whether the client device is allowed to connect to the resolved IP address. A computer program product, according to another embodiment, includes a computer readable storage medium having program instructions embodied therewith. The program instructions are readable and/or executable by a computer to cause the computer to perform the foregoing method.