Gateway DNS Server Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional DNS exchanges are vulnerable to attacks due to lack of encryption, and while encrypted DNS standards like DoT and DoH provide security, they introduce new challenges, such as malware using these protocols to bypass security services, especially in environments where root certificates cannot be installed on all devices, like IoT devices, and in heterogeneous networks where enterprise control is limited.
Innovation Solution
A gateway apparatus with a hardware platform and instructions to provide a DNS server that offers encrypted DNS services, caches resolved domain names, and applies security policies by determining if the destination address is cached, thereby blocking unauthorized use of public DoH or DoT servers without requiring root certificates or acting as a TLS proxy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted DNS protocols (DoT/DoH) are implemented to secure DNS exchanges, then security against sniffing and poisoning attacks is improved, but malware can exploit these protocols to bypass security services
Solution Approach 1:
The gateway acts as an intermediary between clients and public DNS servers. It provides a local encrypted DNS service that mediates all DNS traffic, allowing the gateway to inspect and control DNS queries while maintaining encryption. This intermediary position enables security policy enforcement without requiring root certificates on client devices.
Solution Approach 2:
The solution implements DNS security services locally at the gateway rather than relying on centralized public DNS infrastructure. By providing local encrypted DNS resolution and local security filtering, the system maintains security control within the enterprise network boundary without requiring changes to public DNS protocols or client device configurations.
2Reliability
If root certificates are installed on all devices to enable security services, then domain name-based security can be enforced, but device complexity and deployment difficulty increase significantly
Solution Approach 1:
The gateway serves as a mediator that provides DNS security services without requiring root certificates on client devices. It implements a local DNS service that handles encryption and security filtering centrally, eliminating the need for complex certificate distribution and management across numerous devices including IoT devices.
Solution Approach 2:
The gateway consolidates multiple functions including encrypted DNS service provision, DNS caching, security policy enforcement, and parental controls into a single device. This multi-functional approach eliminates the need for individual certificate management on each device while maintaining comprehensive security coverage across the entire network.
3Speed
If a caching DNS server is implemented to improve resolution speed, then query response time is reduced, but security policy application complexity increases
Solution Approach 1:
The solution merges the caching DNS server functionality with security policy enforcement capabilities into a single integrated system. The gateway combines DNS caching for performance optimization with security filtering, parental controls, and encrypted DNS service provision, simplifying management by consolidating these functions in one device rather than requiring separate systems.
Data Source
AI summary
There is disclosed in one example a gateway apparatus, including: a hardware platform including a processor and a memory; and instructions stored within the memory to instruct the processor to: provide a domain name system (DNS) server, the DNS server to provide an encrypted DNS service, and to cache resolved domain names; receive an outgoing network packet; determine a destination address of the outgoing network packet; and upon determining that the destination address was not cached, apply a security policy.