Encrypted FQDN Discovery via IP Mapping for Cybersecurity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing privacy requirements for connected devices complicate the process of determining the fully qualified domain name (FQDN) of target websites, especially when it is encrypted, making it difficult to perform cybersecurity reputation checks.
Innovation Solution
A method that intercepts data communication between connected devices and DNS proxy servers to map encrypted FQDNs to IP addresses, allowing for the storage and retrieval of FQDN-IP pairs, enabling cybersecurity operations even when the FQDN is encrypted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If FQDN is encrypted to protect user privacy, then user privacy is protected, but cybersecurity reputation check becomes difficult or impossible
Solution Approach 1:
The system performs preliminary actions by intercepting and storing the mapping between encrypted FQDNs and IP addresses before the cybersecurity reputation check is needed. This allows the system to have the decrypted FQDN information ready when needed for reputation checks, without requiring real-time decryption that would compromise privacy.
Solution Approach 2:
The system introduces an intermediary mapping table that stores the relationship between encrypted FQDNs and their corresponding IP addresses. This intermediary structure allows the system to perform reputation checks using IP addresses while maintaining the encrypted FQDN privacy, effectively mediating between privacy protection and security verification needs.
2Reliability
If FQDN is encrypted in data communication, then user privacy is protected, but cybersecurity operation capability deteriorates
Solution Approach 1:
The system performs preliminary interception and storage of FQDN-IP mappings before cybersecurity operations are needed. This preliminary action ensures that when cybersecurity operations require FQDN information, the data is already captured and stored in a usable format, maintaining operational capability without compromising encrypted communication.
Solution Approach 2:
The system creates a copy of the FQDN-IP mapping relationship and stores it in a mapping table. This copy allows cybersecurity operations to be performed on the stored data without affecting the encrypted communication channel, thus maintaining both privacy protection and operational capability.
3Difficulty of detecting and measuring
If encrypted FQDN mapping is implemented, then cybersecurity reputation check is enabled, but system complexity increases
Solution Approach 1:
The system introduces a mapping table as an intermediary data structure that stores encrypted FQDN to IP address mappings. This simple tabular structure enables the system to perform reputation checks by looking up IP addresses in the mapping table, providing a straightforward solution that doesn't require complex decryption algorithms or additional infrastructure.
Data Source
Figure 1A
Figure 1B~1C
Figure 2
AI summary
Method, apparatus, and computer program for discovery of FQDN for target website. First data communication of first connected device related to first target website is intercepted (104). First data communication identifies first target website by first fully qualified domain name, FQDN, and first FQDN is mapped to first Internet protocol, IP, address. Pair of first FQDN and first IP address is determined (106). Second data communication of second connected device related to second target website is intercepted (114). Second data communication comprises second encrypted FQDN and second IP address of second target website. Second IP address is determined (116) to be equal to first IP address. Cybersecurity reputation of second target website is retrieved (118) based on first FQDN. In response to determining (120) that reputation matches predetermined alarm condition, cybersecurity operation is enforced (122) for second data communication.