Hash-Based DNS Traffic Classification for Encrypted Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network traffic management systems face challenges in managing secure communication networks, as encryption often prevents the inspection of payload contents, limiting the ability to apply network management policies based on the contents of network traffic.
Innovation Solution
The implementation of a system where traffic management computers extract tuple values from name service replies to generate name service keys, which are stored in subscriber tables, allowing for the comparison with flow keys from network packets to apply relevant traffic management policies, even in encrypted communications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption methods are used to secure network traffic contents, then security is improved, but the ability to inspect payload contents for traffic management is worsened
Solution Approach 1:
The system performs preliminary actions by capturing and storing DNS query information (domain names, source/destination IPs, ports) before the actual encrypted communication occurs. This pre-capture of metadata allows the traffic management system to classify and apply policies to encrypted traffic based on the unencrypted DNS information obtained in advance, resolving the contradiction between security and inspectability.
2Measurement precision
If deep packet inspection is used to apply traffic management policies, then policy application accuracy is improved, but processing overhead and complexity are worsened
Solution Approach 1:
The system extracts only the essential metadata fields from DNS queries (source IP, destination IP, domain name, ports) and stores them in subscriber tables for later matching. By extracting and storing only these key identification fields rather than performing full deep packet inspection of all traffic, the system achieves accurate policy application while significantly reducing processing complexity and overhead.
Data Source
AI summary
Embodiments are directed towards managing name service communications using traffic management computers (TMCs). TMCs may extract values from a name service reply received from one or more name service computers. TMCs may provide a name service key based on the values extracted from the name service reply. Accordingly, if a new flow may be detected further actions may be performed, including: TMCs may extract values from a network packet associated with the new flow; TMCs may provide a flow key based on one or more values from one or more fields of a network packet associated with the new flow; TMCs may compare the flow key to one or more name service keys; and if the comparison may be affirmative, TMCs may apply one or more traffic management policies associated with the affirmative comparison.