Local DNS Agent Control for Leak-Free Query Routing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional DNS systems face issues with visibility, privacy, and security, including exposure of user activities, potential malware detection, and vulnerabilities to attacks like DNS tunneling, which compromise network integrity and user privacy.

Innovation Solution

Implementing a locally-installed DNS protection agent that intercepts and routes all DNS requests through a trusted DNS protection server, using secure protocols like DoH and DoT, and maintains control by blocking unauthorized communications and detecting potential DNS tunneling attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional DNS systems are used, then DNS resolution is transparent and automatic, but visibility of DNS requests is lost and users are exposed to malicious domains

Engineering Contradiction:

ImproveDNS securityVSAvoidDNS request visibility

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent introduces a DNS protection agent as an intermediary component installed on client devices. This agent intercepts DNS requests before they reach external servers, maintains visibility of all DNS queries, and routes them through a controlled resolution process. The intermediary enables both security monitoring and transparent DNS operation simultaneously.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system implements feedback mechanisms where the DNS protection agent receives DNS requests, analyzes them against security policies, and returns resolved IP addresses or blocked responses. This feedback loop enables continuous monitoring of DNS traffic while maintaining automatic resolution functionality.

Inventive Principle:

Principle #23Feedback

2Loss of information

If DNS requests are routed through a protection agent, then visibility and control are maintained, but device complexity increases

Engineering Contradiction:

ImproveDNS request visibilityVSAvoidDNS resolution system

Core Design Contradiction:

Loss of informationVSDevice complexity

Solution Approach 1:

The DNS protection agent is designed to operate autonomously on client devices, automatically intercepting and routing DNS requests without requiring manual configuration. The agent self-manages the DNS resolution process, eliminating the need for complex network-wide deployment while maintaining visibility and control.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system segments DNS protection functionality into a lightweight agent installed on each client device rather than requiring a centralized complex system. This segmentation distributes the complexity across simple, independent units that handle DNS requests locally.

Inventive Principle:

Principle #1Segmentation

3Productivity

If DNS tunneling attacks are allowed, then network traffic flows freely, but security is compromised and malicious data can be transmitted

Engineering Contradiction:

ImproveNetwork traffic flowVSAvoidDNS tunneling attacks

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The patent converts the potential harm of DNS tunneling by analyzing DNS request patterns for malicious characteristics. The DNS protection agent identifies suspicious tunneling attempts and blocks them while allowing legitimate DNS traffic to pass through, transforming a security threat into a detectable and controllable phenomenon.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

Solution Approach 2:

The system performs preliminary analysis of DNS requests before they are transmitted, detecting signs of tunneling attacks in advance. By taking anti-action against suspicious patterns proactively, the system prevents malicious data transmission while maintaining normal network traffic flow.

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS20250358263A1System and method for DNS tunneling protection

Publication Date: 2025.11.20 OPEN TEXT CORPORATION

AI summary

Embodiments of systems and methods for DNS leak prevention and protection, including protection against DNS tunneling attacks, are disclosed herein. In particular, certain embodiments include a local DNS protection agent installed on a system and an associated trusted external DNS protection server. The DNS protection agent prevents DNS leaks from applications on the system such that all DNS requests from the system are confined to requests from the DNS protection agent to the associated DNS protection server. As the DNS leak prevention provided by the DNS protection agent stops applications on the system from circumventing the DNS protection server, all DNS requests originating from the system remain under the control of the DNS protection server and thus desired DNS protection (e.g., as implemented on the DNS protection server) may be maintained. Certain embodiments prevent applications from using certain DNS security protocols, such as DoH and DoT, without going through the DNS protection agent. Embodiments are also capable of detecting and addressing DNS tunneling attacks.